{ "Event": { "published": true, "date": "2022-02-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-22", "timestamp": 1645574582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8efc0221-f963-4ab6-8e10-d975c923eff8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04c95d2-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550517, "uuid": "d6c0acba-a9ed-41ef-94a9-e45f1b055c0c", "comment": "Malware payload (Heodo)", "value": "910a2616d55c4947bb3af467851f24df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550517, "uuid": "017125e0-5538-4d5b-bb48-51b04468e058", "comment": "Malware payload (Heodo)", "value": "00be839a10920af3eba900729526610ac0c79b5a44a547565ed028ddf9c100fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550517, "uuid": "d48d14d3-c37d-4aa2-9736-9a91f3a8f4b8", "comment": "Malware payload (Heodo)", "value": "5b3d409efea9fd4c56ed740b3dc978d40c78e83d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550517, "uuid": "454feb03-c112-48e6-a9e5-9379ffb66968", "comment": "Malware payload (Heodo)", "value": "0b607883f777540e583ae6a643e7b282caff3d9dbb609ca0e27150c89398d2c3cbd8f3e3794f9e444376c88c7ba45b6e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550517, "uuid": "283f4e0e-247b-4559-9540-38ed4535e4ee", "value": "T18DA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550517, "uuid": "596cdfd6-0f2d-4b8d-863b-151558235c87", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550517, "uuid": "48d02fcd-4f2c-4efa-aaa4-fc10ea55ee6e", "value": "12288:vicw4w2Vb0zq6k5Z2mTijqkGXNrGHORQuBT:viSwub0W6LmTWwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550517, "uuid": "6fb67595-b6bc-4058-9c33-a1173dbc41ec", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550517, "uuid": "f26c676f-88a8-4a06-a308-a5d906235289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550517, "uuid": "b87fcb9a-9dcb-42af-be55-7f73192f2847", "value": "H7smKlrU59SHnYYr6K4H23wK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b38406b-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503962, "uuid": "5926482d-af7c-48ec-b6aa-fc01a5b0414a", "comment": "Malware payload (Mirai)", "value": "2f5a6269d46ae9d8e3bc09c4d735c7c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503962, "uuid": "62999bbb-b929-4539-9048-c08db4d7edfe", "comment": "Malware payload (Mirai)", "value": "020a0e48d91efb46f3ba2357e292e7147eb58b2650c849c45fa8dae868e49b73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503962, "uuid": "b9520dcc-98a4-4a03-9211-0b3204ea8bf8", "comment": "Malware payload (Mirai)", "value": "553c7ad9f51018a62f5b6058ccf43786f9e15d43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503962, "uuid": "7241f027-0c72-4fd1-9733-c75ae9eec122", "comment": "Malware payload (Mirai)", "value": "a2d7cd18fa47bda48ea3813bddd8e79eb0c30bcae32e0768b35bc50a72617a0fbc2f4f8cdc991539d7e64159cac41746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503962, "uuid": "a3e94a50-bcde-41a0-a6db-80cad43342f9", "value": "T1A583AEB1C9682E68C78499B077F4CE3A8323A64085572EFE9295C76E9043DECF5193F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503962, "uuid": "d562da50-95d1-4955-b037-bb62ed51c99a", "value": "1536:xpNikYIoId7Ywf7EyDoHyTd44hI3A1i/8g/sCmkRk+KyVD+41s+z:xeg9SwfEyTd4kRg/spxyAVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503962, "uuid": "59d35d28-6f8c-420a-8503-86d2037d87c2", "value": 84132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503962, "uuid": "de58479d-154b-4f2c-b8dc-3a1986acf9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503962, "uuid": "66548ba1-6799-473e-b772-9cd55cdcae20", "value": "2f5a6269d46ae9d8e3bc09c4d735c7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2432286d-939e-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645506796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506796, "uuid": "b6725306-7939-4d13-b142-412420c926b5", "comment": "Malware payload (GuLoader)", "value": "d15f2e1dd1fa43ef9163e8cf6e1bb7b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506796, "uuid": "5e9e473d-0482-4f03-af02-cd2b8458ba24", "comment": "Malware payload (GuLoader)", "value": "02cf356a772537bf212dcabc540b9ba85e9cc9ce8e751bcecdd69cdbba92cea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506796, "uuid": "4317b2d1-b74c-4f36-8c10-ac7be40cdf8a", "comment": "Malware payload (GuLoader)", "value": "6256961593fa341f81fb5309161e7170c1439967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506796, "uuid": "bc85717a-0b2d-4dee-9e60-6aa218cdce68", "comment": "Malware payload (GuLoader)", "value": "257ea1f8d6b8a8224648af99b9a5a3bd2f3b2d4363071e10d54c8db3fcd26f4a376058ad37a9a67d852a80c537b22ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506796, "uuid": "670db890-4d6b-4ba2-9b23-31e4370b44fc", "value": "T1DFC3E01166A0C567E6E347710978727A9EF7DC2122A2AF0707107E887D739E0AE1FB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506796, "uuid": "8b7c4d41-cde8-43c0-aff1-d6785e2aef85", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506796, "uuid": "7698da57-4672-4c88-a08c-3843e6cca6da", "value": "3072:JbG7N2kDTHUpoui7b91BtNfL/aohDB6w/BDjP:JbE/HU+NtN111t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645506796, "uuid": "bcc032a9-bb6e-466b-be0c-7622f73cbce3", "value": 121760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645506796, "uuid": "87a0667c-6135-49c1-86ea-028625a51e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506796, "uuid": "0612b748-1d82-4372-82b1-c0e7a533d978", "value": "PO70057717316004RTZ_86536954397654000001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479ff3a7-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554959, "uuid": "0f10c1a0-b21c-40a9-b0c9-782e0118f2a7", "comment": "Malware payload (Heodo)", "value": "1b1766b52f727ce0580a3294ba731a32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554959, "uuid": "e6116ac0-9f3d-4ad2-a34a-f301b6ca5c24", "comment": "Malware payload (Heodo)", "value": "0316dfd13ab8d3b96c45841ecdde21ebcddf47886e994e1e786fa8387208f513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554959, "uuid": "febeec42-44ba-4912-9b6f-3b13e4b877fd", "comment": "Malware payload (Heodo)", "value": "b2442718200ea18f5323e8ed4cc47ac51e493636", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554959, "uuid": "f48941b6-8a08-4da4-bccf-ea2924dd02ca", "comment": "Malware payload (Heodo)", "value": "71c2e8fbbbf9acfab83fe7610eec41757a78dcbcf5aa771e3044d9cf46e68a9edbbc5b37e86219a389023e6ba0a52005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554959, "uuid": "afcc2ec2-6d78-4d6e-b7a6-357949513e2d", "value": "T11CA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554959, "uuid": "95611c26-d04a-40fa-84d6-14e89093f534", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554959, "uuid": "8a7105d6-e038-46cd-9825-2257d079ea42", "value": "12288:vicw4w2Vb0zq6k5Z2mTBjqkGXNrGHORQuBT:viSwub0W6LmTnwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554959, "uuid": "b2ea29bb-f3af-4a21-aa83-127079327a5e", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554959, "uuid": "fd70213c-8e3d-4501-80c2-45e2657be0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554959, "uuid": "1aa52aa8-b8a4-426a-9bf8-e4944e5a49f0", "value": "1b1766b52f727ce0580a3294ba731a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925070ce-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645539193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539193, "uuid": "7af5195f-c807-4629-aa28-5f0f4908c389", "comment": "Malware payload", "value": "cfb89fdf1df24a4f94fc6becef6e5237", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539193, "uuid": "b00cf3d2-c802-4793-bc97-6b78ff777b68", "comment": "Malware payload", "value": "036c25ca8f8bfd424dc22bdacdfc1b1b101afd51fa60391253a757c075b62964", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539193, "uuid": "992b1885-63e4-4022-8858-02f26ddeca8d", "comment": "Malware payload", "value": "e41b9a6d98425dba4a005e5b1d4691ea6ebd137c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539193, "uuid": "a844294a-a98c-41d2-ae24-f66c7608dfd0", "comment": "Malware payload", "value": "7b4942d7e494bdd1691758694674b65b534cb02f04e413d039a168e61e0ed6bf95785a2cb7661d53b89351a57aa94a0b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539193, "uuid": "342817d6-28c8-4a24-ad60-fb445fbae837", "value": "T19C75B64DE7902BCAF0D6687CB61C33E99E970FF1097E6072E203588A26B12E49D75747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539193, "uuid": "4d3d8e97-37f3-4f28-a70b-c96111a535df", "value": "84687bd7bcf9c6a61feea037640c3685", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539193, "uuid": "f82a8a0f-7b04-475d-b039-902e15365a05", "value": "24576:i+jyoF+mYqQ+7ddz+CJJGMeGD9ztBG2lqrsoEcRTneGjeBkQf/iDziQkJ4vLJ:i+jy9mYqQ+7ddz+CJcMrD9ztBjlqrJEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539193, "uuid": "1d7c556e-6ebc-4913-8371-43b115c90fc8", "value": 1570233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539193, "uuid": "b2cb5896-9084-4e36-91ab-120b90635fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539193, "uuid": "de4fbc7a-0378-4e3e-b0b3-46efeafdcf74", "value": "ow1.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44166cf2-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490099, "uuid": "66f22f4b-4abd-4d49-81a5-938a8bba55ba", "comment": "Malware payload (Mirai)", "value": "a29d599d1d396f19fd0477464d5cb800", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490099, "uuid": "956c05df-009c-4b00-b1a3-4ca1c5089d49", "comment": "Malware payload (Mirai)", "value": "037adcd372b9f64260e9230696849a325ce2fb18c9617508ead604a9c0ee0afe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490099, "uuid": "ea8426f9-d1a6-437f-80a8-2a8483961591", "comment": "Malware payload (Mirai)", "value": "caeb5889a3ffd35c7a8139f7d6b93107cf1fb731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490099, "uuid": "73444117-95c4-4536-9ba3-02c5facb1e69", "comment": "Malware payload (Mirai)", "value": "10da744806982744d703d22573c79f780a9a1d4d0e51d95aaedc6f73bcbda06c8a34205af76cd074fdb1d003cfa936ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490099, "uuid": "830f28df-f075-4dad-b6e3-e9715e15831a", "value": "T16F539EA1C1B8BDA8D25845B8BA189D3D9723E1045A933DF9E649C797E00BDECF4093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490099, "uuid": "b8ac20cc-730e-4ff9-91cc-eb6e23922261", "value": "1536:C/DqQrxgaywtX+59m0sA6Qy5jAfs3c3/v37b0DCurm:C7qYqp55U0sA6Q2Af+Un7b0DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490099, "uuid": "544f9388-f55d-4bc5-b58b-274cf20e9fc0", "value": 62400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490099, "uuid": "0d30602e-7854-4402-9500-75edfa525e0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490099, "uuid": "bfaeef1b-e081-45f5-8b50-1a7d959e256e", "value": "a29d599d1d396f19fd0477464d5cb800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deae05b8-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550488, "uuid": "c566c298-2ea2-45a4-a17f-8a9f09d9be46", "comment": "Malware payload (Heodo)", "value": "c9210c48e2919fb87b7b91a58c24b185", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550488, "uuid": "f5b49fb4-bdb1-4183-a354-dfaf9852c4c9", "comment": "Malware payload (Heodo)", "value": "03a91327cb3dbefd8f2af383ec7b4247285d5715ab5a6811c7e28235048df4df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550488, "uuid": "0054bfdc-c6fe-4326-9124-73cae0eced55", "comment": "Malware payload (Heodo)", "value": "932bfb9fba579397c2705266ffa05665fd866d5f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550488, "uuid": "0ae6b08e-110c-43d4-92b7-d555b87c2184", "comment": "Malware payload (Heodo)", "value": "505a8e759bd7af2611c891b9fe9bc4557034a382fc3d68e48bf4d8af2930f354478ef50dc2bfdb5a5803d29ef452a9e9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550488, "uuid": "33eb0c5d-153d-4ae3-85e0-f9907e611a87", "value": "T135A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550488, "uuid": "1f983177-7a11-4b88-b88a-1e76fdc5951c", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550488, "uuid": "fca87445-2509-43c5-989f-b25dbbc8752f", "value": "12288:vicw4w2Vb0zq6k5Z2mTRjqkGXNrGHORQuBT:viSwub0W6LmTXwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550488, "uuid": "baad8daa-0ec7-46e6-83b1-742d3ed12ca3", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550488, "uuid": "7b16a971-cc98-48d3-a520-6783659f2af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550488, "uuid": "1d373ead-55cb-4c7e-bc28-92978e1649c4", "value": "ze6CSxtjo4os1ub74cK8Ou0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29edc15-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514336, "uuid": "425d2c86-f42f-4d37-b985-edbb38a03962", "comment": "Malware payload (Formbook)", "value": "e9ffc84abf7ed6f6a7be0c9e347b4245", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514336, "uuid": "ae6bd917-1225-4f9f-a84b-990846e8350b", "comment": "Malware payload (Formbook)", "value": "03d548395841b2296dee9a96f1aca44337f238311a0b01d6cf61c0d998bcc59a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514336, "uuid": "8427b4b1-566a-4bc7-833b-11e8ad506efa", "comment": "Malware payload (Formbook)", "value": "d636a41a99a022b242a810c972f4e6adcc779aba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514336, "uuid": "25090c05-5516-4a6f-829b-82e6bc1b27ad", "comment": "Malware payload (Formbook)", "value": "c14c706507cb170306dca41abac3c57af4842055395ffa8e237b3e91ac6d2f7e509c6aa68939b7434131d24517412d0e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514336, "uuid": "985a0ed0-d46a-4856-975f-57bde484afaa", "value": "T1C21402ECBA7FAB5DF29C56721232522F44EEFD46963B4B9918E03BE500B4C4E4B25413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514336, "uuid": "75ca6f44-303f-4462-a4ca-fb17969d7b1b", "value": "3072:q6+X3hQMFFQVv8V4J0aN0ZCQmVCzeKIhhw0J6il6qeFRJUVI0:yn6CCWVF20XECz9KIDgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514336, "uuid": "84830a24-8499-43d5-80e2-97855139bf4e", "value": 190456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514336, "uuid": "d49e7942-d094-4579-904d-77a3bfb00578", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514336, "uuid": "71f0cce7-5bac-4898-8892-fbc7e0d849f1", "value": "POAT2076452.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae7e067-93fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645547851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645547851, "uuid": "7bdd5faf-09d8-4030-91cc-9d454aa37de0", "comment": "Malware payload", "value": "8c2fada1ba8487439c84fc544667a0a0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645547851, "uuid": "5470dd20-e9fb-472a-9473-b7c42349f826", "comment": "Malware payload", "value": "04308f68547cb80d45ecd71a2b46c7e07a1bac3584869b9d35820322f2d2ec18", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645547851, "uuid": "9c9300f5-a226-4a8c-a519-b8957a705e57", "comment": "Malware payload", "value": "a39747a7c4f95399de4058a155f973eb42968b1b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645547851, "uuid": "057451b3-3db2-4763-ba9b-874c155a975a", "comment": "Malware payload", "value": "caab8e2b5c6d106d7d0cb3047b2c032a1ab2d8611757ad3f5ada0d7aff952552f7e8cc2e4619bf222da24fd229f0678a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645547851, "uuid": "00231a9b-0700-49ad-98bb-2ea12a0965d2", "value": "T171041285F2F05AC8FAA1AF32CC7481405DADFE301BB1A685017AF1DDA435DC1B6935AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645547851, "uuid": "bf326f3d-1584-4da2-93da-257033fa1f68", "value": "3072:KevlIXZbN44FVPkSp4uHjBss2hufFmYeWm3UWBrowtxEn1Pf0q0VFTGStDIj/V6/:sXfp3J3j5hloZ/tSZn0VFS77VbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645547851, "uuid": "7d1645fc-ffda-492f-b74c-86089feb3ef1", "value": 190200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645547851, "uuid": "a7bc4053-78c9-4073-aef9-da2937168d06", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645547851, "uuid": "5e22d83d-24ad-4023-b38e-dbb108242b51", "value": "PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5b5b80-9394-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645502781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502781, "uuid": "7ecae89c-11b8-472c-808b-80b3363c8ac5", "comment": "Malware payload", "value": "8da322aeb3d162c85fae9cd8761472cc", "object_relation": "md5", "Tag": [ { "name": "PHPWebShellFXShell", "colour": "#2858E5", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502781, "uuid": "1c198322-5056-458f-ad28-8312edcd7083", "comment": "Malware payload", "value": "051264e3ddfb562e9e2fe6f5eded4235989ab434fcbd46d21f2227376b9add56", "object_relation": "sha256", "Tag": [ { "name": "PHPWebShellFXShell", "colour": "#2858E5", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502781, "uuid": "864b006f-2666-4f7c-b90e-d23e94d7e966", "comment": "Malware payload", "value": "ee123054dde8d0336f70fd7152025d1b8fb4585e", "object_relation": "sha1", "Tag": [ { "name": "PHPWebShellFXShell", "colour": "#2858E5", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502781, "uuid": "546e172e-8608-40da-b890-2a86a9fa4bff", "comment": "Malware payload", "value": "2a07c247ce90a21ca89e4d5a624b0ec92172d6025be3ef533b1c23fa8b2ac927e3c937371f72d5bfd09f9df34c2eea4a", "object_relation": "sha3-384", "Tag": [ { "name": "PHPWebShellFXShell", "colour": "#2858E5", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502781, "uuid": "2cb0765b-ec3b-4330-b2fe-2053028d1af5", "value": "T1342337268ADCFA1707CCFF04BBE64D3D1102DE25A0D2549BE2963D4A4E1C6C3D51AEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502781, "uuid": "6df824ca-59b8-4572-ba46-3f32e7f53959", "value": "768:s4iDQsJaD2jt/xcVmR4+WAf6HTGabnoEzGbSvUaaqC2E6HfCr4uQKuEu:sQN2jtxYmR4+WAf6Hdbnd1vRaq/S1zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645502781, "uuid": "ea3ca3db-4516-4bec-b75c-afd3c5146d0f", "value": 48135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645502781, "uuid": "ea1a1a21-a2aa-405f-86c3-e04913c79601", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502781, "uuid": "d0d7b6f3-fdf1-4d27-9944-a0fa11900c4f", "value": "eY250jQz.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b28df7-9420-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645562774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562774, "uuid": "1d31cd3e-ecb0-41a2-9dea-3007d5838158", "comment": "Malware payload (Mirai)", "value": "74693cb8163917c1c5487185f033b524", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562774, "uuid": "b5eba4ba-b9ae-40d8-a9e2-d6df4ec1f81f", "comment": "Malware payload (Mirai)", "value": "0512baefb94082308f237a325dbf30263ea0b5c5d2cc6d1a3078833f592abaab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562774, "uuid": "664d6e7c-9f14-48c6-98ed-6efd2b8731db", "comment": "Malware payload (Mirai)", "value": "a9d4ed54387e347be213f2ce759ae338aa12a9c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562774, "uuid": "deee71ce-5e5e-4546-95dc-500730fc6b36", "comment": "Malware payload (Mirai)", "value": "e0fbc0d0a2478f9dbf5bef07a46ee8601d8dfc7d34c7fb7342422c99367aef1f71f7fe7e415778c92fcce2837a610636", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562774, "uuid": "e1e6aa72-653e-466b-8d86-b6f3a1436c98", "value": "T15AE2E12035EE5CB1DF700DF6F27F8A0862A6CBD9D2AA357705081968D0C265E35BA3D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562774, "uuid": "585c9a97-79fd-4be1-ad3d-0dc3898fd93b", "value": "768:orp7p7nnP8NK6ogIEEnKdRPmfCGHLlq+0bFs3Uozb:oDn56G6GH+szb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562774, "uuid": "c430f97f-ead0-4f99-ab7a-e539a8d17573", "value": 33400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562774, "uuid": "a2ca166a-228d-4682-bb1a-68e3388929d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562774, "uuid": "769088f3-a64f-47be-888d-a3e7094b782c", "value": "74693cb8163917c1c5487185f033b524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1010ba-93b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645516343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516343, "uuid": "a8587b30-3a8b-43c5-8883-c21d806190f1", "comment": "Malware payload", "value": "a98973511b2605d7a4876d160c6899cf", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516343, "uuid": "bde6896e-87eb-4e6d-b636-0c15e739a651", "comment": "Malware payload", "value": "0524baaee169fd0426eb08ee95e13e7c4197f2b898f10f3ff4a15e8e5dd16bba", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516343, "uuid": "32d367c3-85e2-4f8d-8bba-6f73c2d7acfd", "comment": "Malware payload", "value": "0bf1cb8e8398eb373522370589f2350411756751", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516343, "uuid": "c47165ac-f41f-42a1-9f63-2197a0d67455", "comment": "Malware payload", "value": "ee4f22b32dd549c5428c4c318f0f65db935744ff9bc8ea2a4c696c9caee54b257db3f4b1efa87315d5e748a3cdef9d21", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516343, "uuid": "d98ebd58-4d4c-4a5b-bdc7-12a416ef1c49", "value": "T12823C018C4026545C673693DC078C4E15DA7DC5BA218488FE6FA7E8B07A8F9B2B4FBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516343, "uuid": "7bdc53eb-1324-4f0b-bfb2-df32da8691bf", "value": "768:n+rRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTx:n+tJqHt7NJECQFfqAmlqNN6rkBZ1/K8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516343, "uuid": "08aff252-fe2c-4e91-b029-62bc87b92c9e", "value": 47968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516343, "uuid": "71fe7a57-a06d-44be-a1f2-079988f20d42", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516343, "uuid": "e06f86f0-c238-4a2a-a8cd-b073b4356d41", "value": "Purchase List.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53571bf1-942a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645567004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "23e8df0e-9899-4ed2-b040-fd96fd185d06", "comment": "Malware payload (Heodo)", "value": "a622733d703732885fef2ee39519d3ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "c0ccddaa-3c3d-4fed-86f3-80b9e0696a87", "comment": "Malware payload (Heodo)", "value": "0547ed94d11cc45cbb2e2de7b8d33e8f326ab7f2cfb3e2a1cc6967d0140e94a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "72bf87b9-bff4-4b3d-9abf-34662bef51be", "comment": "Malware payload (Heodo)", "value": "bac6422feb41c37b8ffd996b9a61e011159e703e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "3cb70771-dba2-4341-85a9-80a420f744d3", "comment": "Malware payload (Heodo)", "value": "b4f2864ae07da2fbaaa88bf2e7f7b12e9e88db27c96c9a5efc4cc32fc2c02e3e38cf96140fd6dd239a5d901e59a4f088", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "451b2d30-6642-42e3-a0ae-7c8f7f419c07", "value": "T1D3B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "524e8d7a-155e-448a-831c-b1b0f01b89d3", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "28a4ad88-3388-42e3-b12c-7f337160e0ac", "value": "12288:IOzyEtBX2ZHq79+E6/G5YgvmgZDa6A9TU:lnmZKR+kYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645567004, "uuid": "15d38027-dfba-44ee-b885-9a401b27a10d", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645567004, "uuid": "7dbbd502-67cc-45e9-a351-8327dd1027ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "3c423eeb-7ead-41ec-b6ac-f1aaed75a250", "value": "emotet_exe_e4_0547ed94d11cc45cbb2e2de7b8d33e8f326ab7f2cfb3e2a1cc6967d0140e94a8_2022-02-22__215640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2fd50e-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565142, "uuid": "02d9ed5c-cfc8-463a-a413-23a008352918", "comment": "Malware payload (Heodo)", "value": "1222233631d3d4a4ddb14fb801a4ccc2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565142, "uuid": "c5309e7b-da57-4746-aece-901948673f0f", "comment": "Malware payload (Heodo)", "value": "069fc66cef716d7f4304e861b6a34f61b558cc1b75e4cb0555fb1e9661ff6cda", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565142, "uuid": "5db9385e-615a-4cd4-9870-cc9c9c24ff97", "comment": "Malware payload (Heodo)", "value": "1be9cd363eb0f208e01023cd1a495087cf133f7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565142, "uuid": "36319f87-ebaf-40de-ae66-bebb0fab8df6", "comment": "Malware payload (Heodo)", "value": "87689636782b595541ca030bac8707908b51f3364ff8d1905bc549098ae879fa0df89e49d5ae1cdb2403a0fe975d3273", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565142, "uuid": "050ac3a3-adc0-475e-843d-3240a7d13c66", "value": "T145A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565142, "uuid": "479c75b7-fe8d-47f4-9e6b-1ce7fd5035b7", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565142, "uuid": "af2275c4-79b9-41b0-aa29-7f3ca8356366", "value": "12288:vicw4w2Vb0zq6k5Z2mTzjqkGXNrGHORQuBT:viSwub0W6LmTVwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565142, "uuid": "0a474687-99ea-4938-b80d-bf51f5ea0fa4", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565142, "uuid": "d2cc13d5-10a3-4c9a-96b6-786cf8e4d299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565142, "uuid": "cbcc06dd-3e66-4a0c-bb29-98a725c586d4", "value": "3XOi2Z5Bd6JUXEjj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7b5f46-9374-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488771, "uuid": "2f385f5e-67be-4936-97fc-1e007c8f788b", "comment": "Malware payload (Mirai)", "value": "526d9ce28d5cfb041f3dbece6337b1c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488771, "uuid": "9ac0c834-a39e-4a77-a7e3-52879b908260", "comment": "Malware payload (Mirai)", "value": "06f1f176e8979a29b92cd9214ba81c81904877a3e323bb66535f333869d1f439", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488771, "uuid": "e448d403-a90f-48af-b0e6-514f363611ff", "comment": "Malware payload (Mirai)", "value": "4f6909703c3651410002e5ded21f02546d88dee4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488771, "uuid": "f12c9725-2a22-4e6b-a963-31353a4795e5", "comment": "Malware payload (Mirai)", "value": "038d217fc7202592259672ea19fde3c78680664f9a3691b8367ea306577e5027d5551e513553058aeeccee8d4b1dbd07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488771, "uuid": "9f262733-3881-4423-bd26-4a3bc3f50404", "value": "T16CA2DF84D2949073FA316532D52B8141320683BCC8E3B625669903BC77C7459FEFEAA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488771, "uuid": "db134ddf-03f9-4b10-81c4-1701d260894f", "value": "384:BzuUSXqVaXbuKf/dL75rKQXKSnHMMhF9PgPZQ+xuimdGU5E/I:B0XqVObzV9BfHNDPgjMi3UcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488771, "uuid": "a6bb7ccf-14fd-4d36-a064-a98fafe7ade2", "value": 21912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488771, "uuid": "23b83218-294f-4014-a5bc-e5a363a658e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488771, "uuid": "5154de29-db0f-4218-a344-97146c7b1ef4", "value": "526d9ce28d5cfb041f3dbece6337b1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ba29a5-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554875, "uuid": "58d256a7-24a3-4116-bf16-60fce5177da3", "comment": "Malware payload", "value": "1fbc6bd14888247e07e7f91aa2dde2ca", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554875, "uuid": "d474c7bf-a0d3-4e11-980a-3cfeb4470d01", "comment": "Malware payload", "value": "0821e2d61475379af1961d5f24a87d7d015ddae89089bbba04a0f97afd37d28e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554875, "uuid": "1040b4af-5baf-4039-8cfe-7fbc5a31bc60", "comment": "Malware payload", "value": "a612881a673d4ad3da986baf660af0056b10165b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554875, "uuid": "27c3fd04-58e1-450b-bc24-8797abe30a4b", "comment": "Malware payload", "value": "73f40a0cc7706d3a76882acebf3c3bd63975b88f8d09fea7f9220f38a76b14f67e78ef083b57bb0a177c24bb3a63139a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554875, "uuid": "4dae99cd-bfde-4a02-8ec9-4722f7bcf94e", "value": "T1F3930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554875, "uuid": "8b01436f-fdc3-40b2-aa6d-de3a7e621c85", "value": "1536:8yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQG7kWvgrPE4nWHPNc2AN:8yehv7q2Pjx45uoDGTj+5xtekEvi8/dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554875, "uuid": "6e927143-19ec-450b-ac97-d9c265ab5b69", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554875, "uuid": "345a45fa-a0e9-427e-95bf-e15f035f46fb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554875, "uuid": "364a568c-703e-4fe3-a726-9b4df047dd8f", "value": "tmpa1hxr6g1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e52f841-941d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645561413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561413, "uuid": "7a5632e9-947a-4811-a904-5f32914d97b9", "comment": "Malware payload (AgentTesla)", "value": "ec448ae157a96c44e264a54758b82e11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561413, "uuid": "f2d09479-94a9-44c2-ae53-19b506cfd8ae", "comment": "Malware payload (AgentTesla)", "value": "0825a28d62c9c53ca0a8207f4b8c8d5c58999b88e22c97c22550a842f182a044", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561413, "uuid": "7dbcc17f-01d3-4e73-b5ce-485225f3702b", "comment": "Malware payload (AgentTesla)", "value": "66745744222e0d0a874c1ba4e14f0d77877b50bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561413, "uuid": "e6fe55c0-7727-4788-ba98-6627ac8b99dd", "comment": "Malware payload (AgentTesla)", "value": "7ecd174a74aaa0cabe9829895d6eb2760f5b20b4f2b1396889cbc91adc5d41bf65cc6946cb0427267a5a0c9b30a72f23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561413, "uuid": "0fa915ff-877a-48eb-adac-61ceccd7fdf7", "value": "T13CF4236E635E0087CAA815B660C3729202F8466BD187F7FB5CD5E0F49BA67C9F4019E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561413, "uuid": "7c4c90ed-1cd6-4326-ae2d-3d7f5695f55c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561413, "uuid": "6e226b7a-df2b-4501-9354-a27934177b15", "value": "12288:gXy1uh+b8P5/oSFcueOJY1Z24fmXD6S4TCWIwJgLW9Vct1Vm9hv5yp57OSO0ZyC/:AhB5/oSFNePQ6jTCWIggLWsDucVOSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645561413, "uuid": "a80915a0-29d9-4d45-ac9d-75ed3cd97351", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645561413, "uuid": "a0814338-ec34-47b4-8b2b-a8c2c6d6da0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561413, "uuid": "0b5bcf50-ed45-45b9-8c82-0229fd05f0de", "value": "PO-0561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2adf583-93d3-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645529771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529771, "uuid": "b296db7b-23e2-47b9-99c1-08284012e226", "comment": "Malware payload (NanoCore)", "value": "36b58c453f008e5409579fa4539a8979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529771, "uuid": "e110a911-0ffd-4fc0-8c64-ad118ea80ce8", "comment": "Malware payload (NanoCore)", "value": "092fcb848e828f36a6588cddc33d4acd5cb63c4d436a30a6d3805c5240ffafc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529771, "uuid": "4b903e0b-a95f-4c78-a592-7b7161c21d37", "comment": "Malware payload (NanoCore)", "value": "26ac247b238510de467e48d584ea27401814a010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529771, "uuid": "4d1fa81a-908c-4b46-930f-4abc5c226e02", "comment": "Malware payload (NanoCore)", "value": "4b0a7df49d1c9fe5e813e8be3d87ef8cf339cd6d112a361c74742565b1d29ad6d0297c2da98e1265286eac4f5ddd499b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529771, "uuid": "24d17b21-a9f2-400c-89a1-d1559e55bea6", "value": "T184254A9D365072EFC86BC972DAA81C64EB60747B930F9213A06312ED9E0D997DF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529771, "uuid": "af29bf7c-2e13-4d82-a283-8c8311d6d63f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529771, "uuid": "e4c1bf56-8032-4c4f-b1a0-f0b8287c2546", "value": "12288:VnPXdbhqzuswNRHwEtYpftT2mRfWFdXP2diZT9l1OkQFFVyy5HWYQ1X6CcDfIBEk:VnPJ4wHwhmTO4TOZym2YQJ6CcDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645529771, "uuid": "e18d90b7-15bc-4a31-bffd-6d4f8a5742c1", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645529771, "uuid": "ca27c788-967a-4e7b-9bbd-564b591209fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529771, "uuid": "caf47d07-ff1b-49cc-b113-16db5680bd93", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566c0d54-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517617, "uuid": "31109290-0e45-420b-a9e6-84e1f5e52a2a", "comment": "Malware payload", "value": "bc2ccf92bea475f828dcdcb1c8f6cc92", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517617, "uuid": "ffa91209-f444-4b8f-ac2e-ac7442df9647", "comment": "Malware payload", "value": "096bae94e09059e2e3106503353b1b4f7116fa667600ca2ab3fa7591708e645a", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517617, "uuid": "0a1a10f7-5e7b-4b86-b7b8-651ef88699e3", "comment": "Malware payload", "value": "f99d6fcaab8f812bf40c15d63bcf8567e874cf2c", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517617, "uuid": "757280be-1341-46f3-96b7-f56c15a17850", "comment": "Malware payload", "value": "41073f10c6396aa8072c414200cc8b926d061392698b1ea3424d110babeab90b6f2471c90c12f6f03267d34c7c78a7fc", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517617, "uuid": "1263b59b-9c0a-4d40-b912-267a95d9a405", "value": "T1B7C2B7063BED5675E2FF4B3DA8B222100679BD4A9821DF6E2C85214D09B3F4C9D51F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517617, "uuid": "0285d34a-1c8e-44ab-b028-007cd4cfca00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517617, "uuid": "a891355a-4025-4340-9062-7267d65ea8aa", "value": "384:OqiBf3fPjDtG11C/Mx9mhh2OdMs6brmmV+uP1svZCT6T3ch4rk0DNYa0bYHVhKja:6vP81VaN2PLHPOZCTE3cEk0DzKja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517617, "uuid": "34a2a528-4087-4c83-9cc4-03d6680e48c7", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517617, "uuid": "425fecfd-dee2-4ae7-a449-1a6609e282c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517617, "uuid": "b0724a6f-ab48-4fc9-9ae2-4ba8ed34075d", "value": "096bae94e09059e2e3106503353b1b4f7116fa667600ca2ab3fa7591708e645a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8f2d32-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549946, "uuid": "01ee4eb2-6095-4dfd-8078-e75485c36fab", "comment": "Malware payload (Heodo)", "value": "8dfd98d7c7244a357f50ca9a12bde932", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549946, "uuid": "67241fd5-84f4-4c29-b27c-b12e08270ab2", "comment": "Malware payload (Heodo)", "value": "09ec410bfe2c6c2045defbb82470af98c10d9aedd7554410e47f5ba3ef24de4c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549946, "uuid": "554a6f65-f16c-4fc1-a539-d265397b296a", "comment": "Malware payload (Heodo)", "value": "62ad8adb8ff301cb051dbea4661905f380f6ee9e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549946, "uuid": "2f9cd339-a154-4e0a-a249-26e94cf87d88", "comment": "Malware payload (Heodo)", "value": "30230cb1dc6a4c3315a513dfacaea3e78e3aa0556e1e38dbbae7f4d4374d78bc184413d86e3e000d4c43512367adf288", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549946, "uuid": "40a06c4c-757c-4fbd-b3d6-d146d03e0a84", "value": "T1C3A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549946, "uuid": "16136385-94cc-4252-8b53-767fc7cba183", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549946, "uuid": "39b1cfce-6c95-4c83-af3b-db519d0f0671", "value": "12288:vicw4w2Vb0zq6k5Z2mT+jqkGXNrGHORQuBT:viSwub0W6LmTqwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549946, "uuid": "d57f7dd8-0e38-402f-bb81-58b252ea90b2", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549946, "uuid": "ee10f182-ebd1-49b2-bf30-85c93ce19f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549946, "uuid": "ff656bf2-13f7-4d29-b609-1209f3d15049", "value": "emotet_exe_e4_09ec410bfe2c6c2045defbb82470af98c10d9aedd7554410e47f5ba3ef24de4c_2022-02-22__171221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26b3139-939b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645505800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505800, "uuid": "85467e55-dfd0-4a37-8fac-fbf635743f57", "comment": "Malware payload (Mirai)", "value": "e3ba1162aafa427d8b9ec39d7ad937b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505800, "uuid": "b47dcf45-605f-4e31-9d8f-d344cf29a28d", "comment": "Malware payload (Mirai)", "value": "0a405ca06db6a5994b376fde29aa3d293c13828ba740a15a37850e5db7100a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505800, "uuid": "4d4fe2ac-6520-48e2-982e-34ed6b85127a", "comment": "Malware payload (Mirai)", "value": "8276f5bb0e7ea28f537d4c8fc82bc11fa3763afd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505800, "uuid": "2a588c96-06c1-40a7-8c98-263b9df6daac", "comment": "Malware payload (Mirai)", "value": "c102d502e5608f0be3e68e0feeedc4fe655ea248ff3e99846f13f486d56a9363fec2d0425009444856c3405bfefaea58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505800, "uuid": "e1a957aa-204c-43d9-993b-e95e70cd83fc", "value": "T1E4D2E1E0D365FAE1CAB91AB0E37C4E419A0918F4D8E63B1521340B5B7EE7B1005AB4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505800, "uuid": "2cf2315a-e085-4aae-bfce-f314109090f2", "value": "768:K1Fswk4vaRry4LJBOkgpFovV62XGHbMt/cJtBq3UIVyk:pwk4vELBK/bMNAuAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505800, "uuid": "bceba0a6-e96f-432b-99b1-cb2901565964", "value": 30268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505800, "uuid": "97ea6bfe-368f-4fa1-a120-2927cacf9559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505800, "uuid": "0bce61f5-3620-4ebf-9ca6-ecd2236939da", "value": "SecuriteInfo.com.Linux.Mirai.1429.27993.4157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed492bf6-93d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645530755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530755, "uuid": "97089f61-3b69-46e2-ae24-f720a4ec70b5", "comment": "Malware payload (Smoke Loader)", "value": "35283c334f846ccb26e3de1061c7d43e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "sokdikksiiefgsdf-cyou", "colour": "#909DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530755, "uuid": "a1858046-202d-41d8-8ad7-55913a9d4c71", "comment": "Malware payload (Smoke Loader)", "value": "0a450a95653d5538130a1ee5ba705d79c909759477d51e5955ffa6663b68dc5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "sokdikksiiefgsdf-cyou", "colour": "#909DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530755, "uuid": "9b32e1a5-727b-4d10-be9f-2fbb0b0bd9fc", "comment": "Malware payload (Smoke Loader)", "value": "64041989bf55e8039fa324611c9ee4b0bd6389aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "sokdikksiiefgsdf-cyou", "colour": "#909DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530755, "uuid": "0d4c6192-3f84-4d23-a8e3-a881d7a749de", "comment": "Malware payload (Smoke Loader)", "value": "1229c52eea5700a598c8b30637a40e2da1d8407fa9cb8dea14277326c96f58429f774cbfe10de5e9f3824f1998d112cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "sokdikksiiefgsdf-cyou", "colour": "#909DC9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530755, "uuid": "b8f434e2-37b0-4bcc-8baf-a9797cb38217", "value": "T161C37D127DE1C436E2E7C9F56974C2D5DA3BB8322FB4855B3604126A3E712C28A2F317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530755, "uuid": "fdd17946-4d77-411c-be5b-c5091944f2f2", "value": "5fbfc74c3ddccb96d094c58debd98462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530755, "uuid": "16ff1624-5542-41ba-979f-120a3f8a0b3d", "value": "1536:X5Nlpvz/pmipW40aPits/gvfgPhzXGPik5AYiH6JFY6FU+j0n:pNn/pmcHk85iPik5A9HQFZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645530755, "uuid": "3ad35621-637c-481f-972e-43800a5c1ea8", "value": 121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645530755, "uuid": "1fe32fcf-9cb5-447e-9eff-ea76a5c1a5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530755, "uuid": "abf1aa5d-2bf5-4a69-b51f-05e4b276734e", "value": "0a450a95653d5538130a1ee5ba705d79c909759477d51e5955ffa6663b68dc5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0fe7b1-9420-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645562779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562779, "uuid": "f3aab109-fedf-4b48-8a1d-6a6926f36018", "comment": "Malware payload (Mirai)", "value": "16523dbf2a392a9463454b528c3508c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562779, "uuid": "ace61340-7b67-4349-9022-58fe8069ad55", "comment": "Malware payload (Mirai)", "value": "0adfd0dac63f92f8cb37704d1053f7bd4d5f200e7426964f27ce960a4c5a9ead", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562779, "uuid": "ad62303c-278b-4af1-a233-a40351d478af", "comment": "Malware payload (Mirai)", "value": "cd01194a57b2cb2f35bd083522a72a23deedc8c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562779, "uuid": "2f076468-8eb1-47cd-a6bb-e72e75ee0499", "comment": "Malware payload (Mirai)", "value": "592b693b3d2d157a79a35a74bc5eaafcada4261ac9bc8783dbc3752b79007a9a34da5c8903d00415eae1c0d15d9f9bdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562779, "uuid": "f5aa88f1-8688-4c61-9b3a-39967e653102", "value": "T155F2E09AF5A96A95FDE97DBD848E26339EBBF0C8716F074863024CC0E54152F520DA3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562779, "uuid": "37085d5c-aae7-4c9d-bec0-3ab05f4bdfb1", "value": "768:Iss1PnyWjbV7YAJf1qyllte6IHD6N6PB5JWn:I7yOCEQylHe6IH9B5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562779, "uuid": "4ed7c09c-097d-4d8e-9c9f-da972789229d", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562779, "uuid": "56589f75-f4e0-42a2-b104-b2ed14c1276e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562779, "uuid": "9b13ba30-0fdb-400b-b4bd-60a6817d8d5a", "value": "16523dbf2a392a9463454b528c3508c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fde552-9412-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645556976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556976, "uuid": "d5016b59-93dd-4e27-8772-ba7ce1f74782", "comment": "Malware payload (Heodo)", "value": "ea7eebe7c7b8d8e8db4f1af08745d683", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556976, "uuid": "dbfdd99b-8074-44a0-8017-752517353825", "comment": "Malware payload (Heodo)", "value": "0ae5fc47a948fdf62d42d7c7ac217c4f6714f46e12a0b31dcffd274dad8ebe0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556976, "uuid": "f0522493-5030-4b9c-bedf-5521b85b64b2", "comment": "Malware payload (Heodo)", "value": "3048b5de6b59cf80226ba5cd26ebb71b98639bdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556976, "uuid": "b429213d-e0ac-4772-97c1-e600b2bf0ca1", "comment": "Malware payload (Heodo)", "value": "8494105cffd7ea86cc482833e6c8aa67aad0195a8a57fe03059cfbf8851fcca5161a339fe65163fa650cf95ed644affe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556976, "uuid": "904db08c-3a65-489f-9efd-8d9ffa6f64c0", "value": "T11CA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556976, "uuid": "d2856216-5f1d-4e17-b29e-7ae0946f1c5c", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556976, "uuid": "dc704b87-78e6-4c03-bcb4-55514e4b8b9b", "value": "12288:vicw4w2Vb0zq6k5Z2mT3jqkGXNrGHORQuBT:viSwub0W6LmThwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645556976, "uuid": "85992907-7258-42e9-b4bc-06c7f6367e6f", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645556976, "uuid": "1841a8d8-d4db-419f-978c-55e59c3ab6ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556976, "uuid": "6cb2a348-9485-4519-bc64-42d47324437b", "value": "ea7eebe7c7b8d8e8db4f1af08745d683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec736dd-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645514491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514491, "uuid": "77795447-e654-4056-8954-fdfbe70d0548", "comment": "Malware payload (AgentTesla)", "value": "82a4c00e571d8661c80c8f7b6d19dbb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514491, "uuid": "849dc95b-98f6-4131-82a1-2812f7419369", "comment": "Malware payload (AgentTesla)", "value": "0b260f2d1e7f61f3acff74fa6598446b64a378de0d908b10490214d2aa23b5aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514491, "uuid": "0ab0d8d4-6840-4d8b-be69-2b7ff720699b", "comment": "Malware payload (AgentTesla)", "value": "02626ac1230e68fdae036b71e8b65c3467b9a715", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514491, "uuid": "8e2d2868-6d00-4422-a3e0-b5e762fbe84a", "comment": "Malware payload (AgentTesla)", "value": "3d2699abb9fdf7a43bf8003eeb16aed016aa6d109b4fe2983699a6b4693cdd7fc1803d00a6b4668ca9f1022ff58e465b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514491, "uuid": "434c9aec-0da4-4251-b691-5e8735bed66e", "value": "T17CB42353BAF80D84F0DDB3487E393AF00BD6851E671908AD31AE92A054513EDED7DB29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514491, "uuid": "d1efb6ee-159d-4156-b2e9-f8d0b0f44a48", "value": "12288:fYI6iSHRoN79DyE6+oh7a/42TQIhZiFZAkkFOlVgms7mdDu3DE:fYI6HO7i+aa/1k2AF2kOOlynMDo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514491, "uuid": "532f5707-6b6a-434a-ba99-561057b9c12a", "value": 531880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514491, "uuid": "d05a2090-a1c5-4303-ac12-3cb59bcaddae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514491, "uuid": "dcf3bf05-0c05-48dc-a1cb-ce48520932dd", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8bb4c8-9408-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552341, "uuid": "240bc0db-0660-4a62-98f1-845a639e9b08", "comment": "Malware payload (Heodo)", "value": "aba327b1dee4f680a02a100d05eab96c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552341, "uuid": "caffbff1-2a6d-4a1b-976b-20fe21191de5", "comment": "Malware payload (Heodo)", "value": "0b93905e23bdf1792c83cefa3822c998a8c339b17166debc63010d4a213c9b79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552341, "uuid": "7fa6debe-dbb4-4712-81b7-f2a4f58e1147", "comment": "Malware payload (Heodo)", "value": "74e086312b136e9424963e1c574cddf545fe520c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552341, "uuid": "d24fa452-4979-4899-a74c-6e894942b837", "comment": "Malware payload (Heodo)", "value": "781ffb7885fde4ecb8a47c0ee71724291c424ff28b56386c5aec27fae748ac85aa94c8948e7362e4ba0e16dc9101d1f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552341, "uuid": "7cb6deab-f6d6-4430-b6ff-acd2351dd56c", "value": "T151A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552341, "uuid": "97aeb529-76e2-42a9-8eba-0071d8ff3800", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552341, "uuid": "efe156d1-bb28-4afd-844d-769e87850ba6", "value": "12288:vicw4w2Vb0zq6k5Z2mTSjqkGXNrGHORQuBT:viSwub0W6LmTmwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552341, "uuid": "c9a958cb-76f7-4211-b3c3-87f08e3a7a22", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552341, "uuid": "71784aae-2dfb-470a-bcff-35df893c31af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552341, "uuid": "e5dd1917-e31a-47b8-b105-e21ced10f40c", "value": "aba327b1dee4f680a02a100d05eab96c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc36e42-93c4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645523458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523458, "uuid": "2db9397d-70d3-46b4-9556-f2a2867e4d01", "comment": "Malware payload (RedLineStealer)", "value": "b94d9de51ecd361982993391c5757514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523458, "uuid": "402c5688-884e-45e4-9573-9fb9133cf346", "comment": "Malware payload (RedLineStealer)", "value": "0bb9a534ba7407c28a442391b6ec14904db57f85874e6dd67234b77ba8ab15fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523458, "uuid": "04c26112-507e-42e3-a9ed-8e681bb5c36e", "comment": "Malware payload (RedLineStealer)", "value": "df252dbb85a426bc50fb692edaf4cc5ad8a9ef28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523458, "uuid": "af8611cb-bb0b-4926-97e0-c7e6512cf6dc", "comment": "Malware payload (RedLineStealer)", "value": "dcd98800197ba8c37e1bd717e2c276ebf8eb7924f53a1c40b163efe2e42373f162f7cbd31dca98535f51285d09fe6a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523458, "uuid": "e5b6a08c-6cfb-46c3-97c6-31e169c9a2be", "value": "T110363374711B51F0C44FAF30822C960B74C7693D6C68CADDD218AA5ADE1B714E436EEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523458, "uuid": "d57c11c5-8526-4db0-adc9-99fe806462fb", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523458, "uuid": "b5b0467b-b728-4bae-a518-a9f03d7259aa", "value": "98304:4wXi9nfOWoNB9c0MimYs48d/f8y8YVEQKLjLRaNMu6dCc+k:4wsmBNB9rMiy48d/BfEwVyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645523458, "uuid": "b1f60710-92ee-4bd7-92ee-e5de88fa2045", "value": 4887552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645523458, "uuid": "d85c8fe8-7741-4339-8d22-8ab9eb40a9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523458, "uuid": "78ebd9a4-1f81-4892-a551-a3ddd6b15f45", "value": "b94d9de51ecd361982993391c5757514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c35fed-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554874, "uuid": "c8d98ff0-fda5-4f34-8df6-beadcbcf5b62", "comment": "Malware payload", "value": "8fd7979dccc0170bfb3a586d28d572c8", "object_relation": "md5", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554874, "uuid": "5e683c63-5f2f-4ebc-8bb6-a946a4b11c6b", "comment": "Malware payload", "value": "0bcec1d4172f5edf9956023c08752b93be00eee1d1dd7ee027e70bab737bfedf", "object_relation": "sha256", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554874, "uuid": "34bff18a-9acc-4a97-8c3e-9e5a2017e5ed", "comment": "Malware payload", "value": "85873a74e36ec1f8e5c92a28492be96b7fc1afee", "object_relation": "sha1", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554874, "uuid": "d6afff78-f7f2-4194-9faa-58baab24d4ef", "comment": "Malware payload", "value": "e82b26e8bdfbc8b4fbc02094115ed02fca2661ffd5a5cae32dc11af6aacd2a79592acd76adb2c4f4c61b8761cab38e01", "object_relation": "sha3-384", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554874, "uuid": "a2d53b24-403f-4c52-a108-99edaea385bf", "value": "T189410112721939E6499261DA96A19A22B0BC08F366D7C909F85D443F43702AFA5A03DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554874, "uuid": "5d458a62-cedd-4fe3-a5ed-eec07a69b6b4", "value": "48:lWBunKUUBbKhKAuqu4ZYcqnqkRyq1qnHYG1/eBFMc1aTg0:lg+wZcqnqksqe9yjIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554874, "uuid": "cbc39edd-d2e1-42ea-bcc8-26ef5a07439e", "value": 2319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554874, "uuid": "c01ef7dd-8600-4cb3-a889-ed1186a073b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554874, "uuid": "a6d75249-c964-4bbc-88f0-93d192cdf0ff", "value": "LZAVOBYIRFWZQZVCTGHPQB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84ec05b-93f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645542773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542773, "uuid": "a216eabc-9ffb-4c28-8cd1-a94cc0c6eebf", "comment": "Malware payload (Mirai)", "value": "23a1d56ad9ed5925074a11e1b7696987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542773, "uuid": "dff26ad7-6eb4-4489-b178-5762e6ba3136", "comment": "Malware payload (Mirai)", "value": "0c2124d45ec8296b3bc2b2b6f538eb6ef0b17394ae53c61c74c50f1fc93badb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542773, "uuid": "f604d5df-5ed5-402a-9993-ed17726366f5", "comment": "Malware payload (Mirai)", "value": "9860df10eba23caadd50417e172c7c6b9f92b7c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542773, "uuid": "7e1cd9c5-5c92-4089-9ea4-e030d28d13ec", "comment": "Malware payload (Mirai)", "value": "6576cb77f82fafc4be54a8c691e3ce03cf091ae6a3022e593748034faaa1adf9717316edcbc148b0fb6d3f2544977e37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542773, "uuid": "da82a32d-dde9-4e4a-8b85-948921d22b7b", "value": "T1AF43022C72E798AFC7154FB8974913B97D94F0CAF90F4F69AA205C905307827F8912E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542773, "uuid": "7adf77b9-d942-4726-a09d-9baf6af5bdd5", "value": "768:gQNWR8Kdra0OvabK3ni8uEp4xLyroQodQGrYZ76q6S4WryNmWqOUmm0N0:/U+Pv3nDUcrnZ0qv4VoOUn0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645542773, "uuid": "871b8135-d6ac-4a8b-8a32-544b878d045f", "value": 59476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645542773, "uuid": "82ea5c5b-94f4-4a78-8398-cf0834460381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542773, "uuid": "1802aef1-487a-4dbb-84ad-ee624d69a729", "value": "23a1d56ad9ed5925074a11e1b7696987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3e68e0-93bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645519968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645519968, "uuid": "b4d05f1d-0e6f-47af-b7ee-9b62eca5fe03", "comment": "Malware payload", "value": "9243bbdc47535e088fd1bdbb63e8bcf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645519968, "uuid": "1ea0e916-a51f-4f55-aa65-c3ae326616f4", "comment": "Malware payload", "value": "0c25a05bdddc144fbf1ffa29372481b50ec6464592fdfb7dec95d9e1c6101d0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645519968, "uuid": "c10ed9a8-e1c7-4033-af5f-0cb66ec93422", "comment": "Malware payload", "value": "aa16fa08fad044b060892a4541cf040898db070b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645519968, "uuid": "1f94ba52-1b80-452a-9659-f80d35cdb925", "comment": "Malware payload", "value": "e4a90275dc8f225afc5784aa32f9b740a734e4ee8d8b4d92e662f4e7f7ebcd86bdfb6315805ad46e28cc55974122d4cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645519968, "uuid": "04369489-cd5a-4018-a03a-a3e98a719553", "value": "T1F23633FA9D3106336DE2D37EB16E641262C2E77B51DC8079DBAC24E3123FAE11251C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645519968, "uuid": "ab7d93f8-912b-4f00-a3be-622d3d7ec936", "value": "98304:BA6Af/TOhE5uP0D/E9DHevlMRYhwVIz3hDNNnWEJjCWJiB:Bj0TBul+dMRFVwpNdmsiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645519968, "uuid": "483278c2-e242-4437-bee4-3f6be3a99512", "value": 5114488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645519968, "uuid": "d781da4e-e6e1-4424-93fa-9168763f6b83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645519968, "uuid": "5bca8138-c4a4-471e-9c02-749d15e84110", "value": "fs.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f25e8c-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517268, "uuid": "c7c7926a-562c-4e09-9924-2d15c3b37817", "comment": "Malware payload", "value": "38090473f1399f8070a7ef7351c7439a", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517268, "uuid": "4984a140-c754-48f7-a5d1-e239417f38ef", "comment": "Malware payload", "value": "0c2a4483319382571e9b470d292d0b4bdd4e7e700ff5722a979e4498c147693f", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517268, "uuid": "1da83b23-3a10-4177-a583-b800dad84ca7", "comment": "Malware payload", "value": "0f64a39c6a80cce2b58b1c8025a57c33a0d02351", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517268, "uuid": "0cd684f0-727e-4e3e-94ad-6b9c2eae9ccc", "comment": "Malware payload", "value": "a504a9b5ac3c44452c1e5fe149833b272f7e6bd6b54adb37ad4e2b60f68cbfd5c95b35a14ac8eee92d101e0bcb823005", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517268, "uuid": "680c1678-deb8-4316-b530-f95de2595b42", "value": "T18FD46D51BECA6EA1EFBF47B78361D62D0126736E03A0A6CF6603019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517268, "uuid": "3b1614c8-cf0c-4205-97ba-59b68bb04095", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517268, "uuid": "ce8fa910-c259-4004-a988-f334ab723f08", "value": "12288:O0Ws7IMsR4yVld8bzbBSrepBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqj9:O0bskX1ZBY4ZyrE7K3yl8PeVooA/AB2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517268, "uuid": "9c0e018e-0506-4129-8c39-59444825265c", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517268, "uuid": "d41bcca8-8365-4f72-96ce-7555f1c40165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517268, "uuid": "71a21e74-a5de-43c6-a149-050865716b0b", "value": "Factura 0000000078.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88af2c06-9407-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645552062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552062, "uuid": "6e5ec4cb-d09a-427e-9f87-668adc4c4ec8", "comment": "Malware payload", "value": "209670bcaa5e2eeb7edeca096c4b1c68", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552062, "uuid": "ed645e1b-3cf6-46f4-8b9f-013557e7fbd5", "comment": "Malware payload", "value": "0c53558df0d78350599a8141237695a873e4d43957d7fb9d2a4424f6941ec2ea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552062, "uuid": "14554280-7a0c-49f4-bfff-bf3f20d73dc1", "comment": "Malware payload", "value": "d35d03b961658dd107c8a904e8de1023da12a637", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552062, "uuid": "797f4717-b944-46fa-b154-1d610cc3ec10", "comment": "Malware payload", "value": "1c642f2cc8e5e9c854b7aee94119e2d9cae55bdf131e882c5dffedb86c168e8227184c0ac570a407ff44c6a7636d6946", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552062, "uuid": "94dd97d2-20c6-43bf-bb0d-74b7cd7f06b6", "value": "T145930769B681C95BCA5807344CD7CBF67227BC424E7983473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552062, "uuid": "2a7feb22-b727-454a-b024-49d544bfa72c", "value": "1536:xyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQACkWvgrPE4nWHPNc2A5:xyehv7q2Pjx45uoDGTj+5xtekEvi8/dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552062, "uuid": "191a5d9f-82b7-48bc-b7b2-fead18655a94", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552062, "uuid": "229e9072-b288-47a5-9dcc-4616c8b2837a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552062, "uuid": "0d0ff3eb-3a9a-46ea-9b5c-63acd85c1afe", "value": "tmpr98z_5dq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1297c01-93e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645537124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537124, "uuid": "2522efc9-b4e2-41c8-a841-bb258d3ca3e2", "comment": "Malware payload", "value": "c2f9c5847498839d2fe682cb74f137c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537124, "uuid": "606b82e9-80f8-4901-8fef-f61f0133c279", "comment": "Malware payload", "value": "0c94ef3c28ffbaf2409280898565f42a61649537ae24a308a343b6da4b4d55e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537124, "uuid": "5f18dd64-efb9-4a4d-84f1-9720b5b6b3e3", "comment": "Malware payload", "value": "97462d5040da273fb3a056099306b8435a0df516", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537124, "uuid": "09b709d7-4baa-4046-a2e0-dcc33d832dff", "comment": "Malware payload", "value": "68de9b9fc9584fa87f486abc49c1c5c1cbd5ec732cf74b39621e772722ea4ef8fea70863348b67f0a3e8ae3b5981c3de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537124, "uuid": "c30562d8-24ed-4f1a-9794-86e35c9dd121", "value": "T11463951EB469701E13883AE19C104EF785FB48E9124D538BFBEDAC607DD6D502DCE68A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537124, "uuid": "9eaf9df7-7267-47ba-9204-1da3de5cba70", "value": "192:n3MS0NkNa2YRjKoCSPzAcsjidUCJHUL0/mCbwIMD:hAkeK37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645537124, "uuid": "1d43f39d-471d-4cfd-aa18-b83dcccb39a8", "value": 72782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645537124, "uuid": "bac59a72-92b6-4d6f-b856-9873146236c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537124, "uuid": "0f7e83e5-3fba-429b-8286-4507aa9708d3", "value": "0c94ef3c28ffbaf2409280898565f42a61649537ae24a308a343b6da4b4d55e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b2a491-9406-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645551815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551815, "uuid": "22a33f1f-7910-4bf9-8273-109955e59761", "comment": "Malware payload", "value": "c133a5a8e92fc6153a43318c37800050", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551815, "uuid": "9c0dc99f-7737-44b0-8c57-ff7bfbba833f", "comment": "Malware payload", "value": "0ccfb233a6d245f9f626e6f2e320497c44870d23ac070821490de5495ad5978a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551815, "uuid": "9b9eff48-9cd9-4288-b248-b286fa4f3a7c", "comment": "Malware payload", "value": "7114618997f078043ab6c7db0ef5fc494314ab5f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551815, "uuid": "ec268287-97d9-4b17-8c40-3b1da09524c4", "comment": "Malware payload", "value": "b441b50bda9447140cfa78448ea574f17ca9d2822191d4be7dc10fdb012b39c3c72bbc87cb236b923fed1453b35d7760", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551815, "uuid": "f7101cc5-e8c4-4cab-94b3-be99d321f84b", "value": "T1A2930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551815, "uuid": "d70543cb-87e9-4ac0-a842-bf806675dd08", "value": "1536:iyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAXkWvgrPE4nWHPNc2Al:iyehv7q2Pjx45uoDGTj+5xtekEvi8/dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551815, "uuid": "20b497e1-3ed4-43ad-8c84-1c2d4c856821", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551815, "uuid": "24f7aff1-78d1-4744-8698-c570fd802b97", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551815, "uuid": "963ea1a9-d847-44ae-aa94-14261f7cb748", "value": "tmp1tpn1zta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b195765-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490030, "uuid": "9ecd71ba-5dec-483e-aa0b-95ada6556bd7", "comment": "Malware payload (Mirai)", "value": "ab487739a1e1ef2343d98bb087953a53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490030, "uuid": "1677c61c-b2b7-49b2-94ed-16606e78e601", "comment": "Malware payload (Mirai)", "value": "0d6c61c13206ded21ec565766e89b46176833fafd2308ca063061bc2a1cefd8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490030, "uuid": "aa8e1f4a-b4c8-4964-8e9e-0a232c7a5959", "comment": "Malware payload (Mirai)", "value": "c45be5b247133c7d837994c9757ae7f87da58bcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490030, "uuid": "02b0853b-6c47-498a-b1d8-627283e64c36", "comment": "Malware payload (Mirai)", "value": "8c8909014ea695a1d8d28a2f4d198058316476b77e54fc2d74c892a7e8b03d673f5ea80269a668e40575d76c5fdbc4bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490030, "uuid": "fc94148c-9498-4caf-870f-3ec6119142b3", "value": "T1DFE2F16DD56FB872C6B4227ECD55CAEE0AC555F8C01C794251925AA87C8130EA3E8D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490030, "uuid": "90ed2e4f-809a-4ce7-8158-b1e448c04e5f", "value": "768:7lIEmC20OgbTOVQtyLg/P29k0ZtgBTRRB62U3znyb94k9q3UELbq:RIJvdgviQtyU/P29XZtARdUMONL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490030, "uuid": "0e4a68c4-9a83-415b-8c62-38339445aa50", "value": 34120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490030, "uuid": "9c366fb5-4b19-4ade-8ee9-ba398a677b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490030, "uuid": "2b159682-9a41-4a54-aee6-eceae7d07f8a", "value": "ab487739a1e1ef2343d98bb087953a53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9d04a5-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "9617e12f-7e6d-448b-bcd7-8050ad524bff", "comment": "Malware payload (Heodo)", "value": "f0927b766c38628750cced1844f75b52", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "3b875cfe-f5a0-42b5-a0a2-1ef9aa18c43b", "comment": "Malware payload (Heodo)", "value": "0df2277c66c13e16f205f0634bd47294c4463f3842619ca54309931d316fb94f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "0ddd009c-2c2d-4b10-9be4-6e76d8d21c53", "comment": "Malware payload (Heodo)", "value": "8ca0100ad7edf4c75765211f0953e60c8b2147f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "baa6619e-e797-467d-b0a3-10a8f3ba1a97", "comment": "Malware payload (Heodo)", "value": "e23e44947dde7845182fe467509aab504b8f73fcf87f2c036022e37176498fbe5ffc35c5c7171e7a1347c35fac9b99a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "fed2169b-efe8-4698-bc99-fc25e6aa3602", "value": "T183A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "cfcd47f1-3951-4e1a-b241-b300b031c29f", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "204990e5-c580-4bd5-9d80-bb6f072a88e1", "value": "12288:vicw4w2Vb0zq6k5Z2mTTjqkGXNrGHORQuBT:viSwub0W6LmT1wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549944, "uuid": "37d713e1-7139-42bf-94bd-16f0f3e163c6", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549944, "uuid": "e6e8db37-a12b-41be-85ed-2f264910c1d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "70ea288b-8ddf-4f82-bb60-e1848cc1a125", "value": "emotet_exe_e4_0df2277c66c13e16f205f0634bd47294c4463f3842619ca54309931d316fb94f_2022-02-22__171219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fc85b6-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645516169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516169, "uuid": "a02514ad-66fb-4681-b2f0-aeb53dc3395c", "comment": "Malware payload (Loki)", "value": "903200a57a7532b8859682c78688b2bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516169, "uuid": "569014c8-ffdb-4e1e-bab3-94434f1d89a9", "comment": "Malware payload (Loki)", "value": "0df7366bf6c0dcf5e7cf039b751534007dbc547b2cf4a6bfd083b7e4f471cf7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516169, "uuid": "b9e2506c-5320-40d6-abf1-560ae10f0919", "comment": "Malware payload (Loki)", "value": "b766a68f8000fab160719c8ac4f30f5370a19f14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516169, "uuid": "ca2997ce-8ba0-4808-9012-4a5015d606ca", "comment": "Malware payload (Loki)", "value": "86cf09fa79a9b28594b163faa6a65898a39e34516280bf0c5a79658f5332b1e3ade9e4107fab75ab75fa41e5a3f16ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516169, "uuid": "a9cfd44b-6ca1-41a5-ae3a-e20d1cb26487", "value": "T13BE4DFEC287750F9E3368ABE9DDCE4B0CF79E6252105E8BD78D92B064741B848CD1279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516169, "uuid": "e7ee225c-a446-432d-ac36-19cccf71042f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516169, "uuid": "cf281d37-75b0-46b5-8ec9-ee79e2d06e10", "value": "12288:Mby0chFFQWNwrJnVaZ3o6Pa5LuvcymfFwMmrFh0MAtevBa/2nSxlTmQTpHe55K+N:MbHchFwJnVq46Pa5xyxF+McyOsQTpHe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516169, "uuid": "0e5b0380-e696-4418-8993-45f16754e022", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516169, "uuid": "6e60cd3a-e98f-4eff-89dd-17c734b9a2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516169, "uuid": "9f01ed13-3153-4d68-a793-30b6d40478e9", "value": "Samples Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dfc4e7-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518021, "uuid": "9fd15905-29a3-4a37-9734-0d240ed12c91", "comment": "Malware payload", "value": "1a61d5fa010ccf2c7ac43a159f9e7158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518021, "uuid": "2587b23e-dfca-4e3d-8ffe-31609c858f30", "comment": "Malware payload", "value": "0e2b3921d6c6c5a65c93b3388801da14896d7ecf7eb581354f42ec52b56e5372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518021, "uuid": "c292d31a-100c-4e10-bb97-14ba62534e9a", "comment": "Malware payload", "value": "5f21ba335329642f27a2763ff9319d2c52edbb34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518021, "uuid": "506c0039-8818-424c-b94f-a5ba830be45e", "comment": "Malware payload", "value": "8521c94f6e2bb421648ac06ab277bbeed2a82bf8e011ac6e529412f380df11560d8eecec0290ef18a2553c9596d6702d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518021, "uuid": "5987824c-8b06-4c4d-bc37-0897a748dbc7", "value": "T1137633F2FBE1F83AE0145479B80960B86ED69DFFAC60A063E247F64D12F49C4546943B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518021, "uuid": "add0fadd-0822-486f-812f-c9d923f93073", "value": "8121da246ea94cbab5bbea46d181bdcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518021, "uuid": "a2af8f43-fe2a-418f-baeb-9250cb44e2a4", "value": "98304:2MDMbOr45SF+n7MDhP/j2VZgw39wMYM60wBzvdtJYyRzqfCk9Mx47/3XcSaBPEKM:2AMtWhnj2Vri3M6067cfFV175y+U1z4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518021, "uuid": "9bf814df-24a4-473d-a575-c91877363553", "value": 7478962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518021, "uuid": "e5a2fd05-193c-417c-ac9d-ea6d0422838d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518021, "uuid": "ed7ecc42-98d3-4737-9af6-d10f176a29a1", "value": "1a61d5fa010ccf2c7ac43a159f9e7158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dc8824-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554342, "uuid": "e82c7e33-2123-4557-8ba0-ec8456531618", "comment": "Malware payload", "value": "425336c316e3d6887f054f58cf6f5fe6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554342, "uuid": "96abc19e-f79d-4c58-8142-cd6514138ea4", "comment": "Malware payload", "value": "0e359c75cc5fedd733f1255b3bb8fe56b97381b1ce40b7c5eda88f1df35d045a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554342, "uuid": "c6bb41dd-43f5-40be-a86b-fc454f71420f", "comment": "Malware payload", "value": "c513058d589425e87b0ad3a3955b30db0a60933b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554342, "uuid": "8fe37a2e-a9cb-4f1f-933f-da7528794d18", "comment": "Malware payload", "value": "34b5715e5b7e9b3890067b812cdde44502b417d537816b931877b2955369bfa539decdde3a00efecdf4d3135ca939fa3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554342, "uuid": "066e396d-543b-4346-abe4-f6c0585e5433", "value": "T197930869B681C95BCA5807344CD7CBF67227BC424E7987873258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554342, "uuid": "d71e4447-27cd-48f5-b06e-ae0c027e5eff", "value": "1536:byehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAqkWvgrPE4nWHPNc2At:byehv7q2Pjx45uoDGTj+5xtekEvi8/da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554342, "uuid": "40bfdda5-1d9f-43d5-bb42-c8344cc9c356", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554342, "uuid": "ccfe08b4-a25b-4e6d-8a84-49727d4385a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554342, "uuid": "67ad66da-5f6b-4e35-bf3f-2f31698675e7", "value": "tmpwosd_urt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737f0eeb-9427-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565770, "uuid": "1f33a09e-f839-4365-a1d4-6bef463836d0", "comment": "Malware payload (Heodo)", "value": "714c72049f048b5275d5e0f951acfad0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565770, "uuid": "172d3c7b-15cf-4417-a6b5-a5e9f7513325", "comment": "Malware payload (Heodo)", "value": "0e6625fbf3e2b0958901c6db754f1a50ee4915bd943a28b871c9244e89c1c2db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565770, "uuid": "d7cd4ee3-6a40-419c-96d6-9ec7bc5241df", "comment": "Malware payload (Heodo)", "value": "3e40cbe3d82e8857ffa8f359b795b4a65c521d38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565770, "uuid": "bc86f396-e752-4889-9d05-999e6fa1c27b", "comment": "Malware payload (Heodo)", "value": "7bbe2ccad7884af3b55e355621cef43adffbd851e4dd11c8f89ca97e68ff40586b21bcc40ed749a899cfa21088f577a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565770, "uuid": "69bc5125-5e21-491f-9cda-fe244b59ceb3", "value": "T187B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565770, "uuid": "e4574456-7381-4762-b971-e0d0b7ecd21a", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565770, "uuid": "8c1282aa-2fb1-4ced-b023-212562a7dc5f", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wRIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWuzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565770, "uuid": "93a6628e-490b-48cc-b880-b57752ac8b63", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565770, "uuid": "028f271a-a8d3-47e9-9b70-cbaf24e020e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565770, "uuid": "717bb72a-ed78-4964-b711-ebbc44b89ce0", "value": "714c72049f048b5275d5e0f951acfad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f491cfcc-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550525, "uuid": "b3344db5-f46d-4f51-bf6b-8bd26b3d3de2", "comment": "Malware payload (Heodo)", "value": "108b628449ae30ef73ab873d5f88e704", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550525, "uuid": "c4c2301e-c167-48e4-8c14-bf59209f9b11", "comment": "Malware payload (Heodo)", "value": "0e83c4885151ac603ee044ff1612b81bc896509e01a80cf8acc62df5e0cfe6c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550525, "uuid": "1d5148c9-410b-498e-833e-1e16dcd57bb5", "comment": "Malware payload (Heodo)", "value": "fdb85c760c27d08a86f3ca2c4c50db4af4e401ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550525, "uuid": "e22e10f7-e430-4cc2-b025-55c07eb5419c", "comment": "Malware payload (Heodo)", "value": "49575a64d7eb3ff4a64aa095d254611b9db2f175883006504ff542d7e6beb4cce24f487de067629dae282e978e1fa3bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550525, "uuid": "c3b3b0a1-1997-4fa3-821e-9bff8749c170", "value": "T137A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550525, "uuid": "91ef9807-a2d9-45ab-9584-358d672e16df", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550525, "uuid": "ac507f74-8ab4-4c04-9dd3-f51b40becbea", "value": "12288:vicw4w2Vb0zq6k5Z2mTRjqkGXNrGHORQuBT:viSwub0W6LmTXwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550525, "uuid": "fad8671b-4ddf-4eb8-aaae-2e9f0b2cd5d9", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550525, "uuid": "641c8679-fa4b-4d37-9fc2-0106f87224b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550525, "uuid": "bcebd6d6-b989-45b7-946f-e7b9833a3bad", "value": "ZVPqGNqBc6cHfDzH2SttskWbH.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e73df4-93aa-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645512300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512300, "uuid": "71efcf29-93e2-49a0-ac9f-939d4bae90c0", "comment": "Malware payload (AgentTesla)", "value": "0ddb64bec6876c8c78c66da1004a493f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512300, "uuid": "9577443d-1204-42d0-99e6-6110c9e58ff7", "comment": "Malware payload (AgentTesla)", "value": "0fbb792d3cff4828fa002e3070ac36dfc3ed91085786c11fc70785be12eaa51a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512300, "uuid": "990838d4-4e66-46d1-b4c3-711a823d0fac", "comment": "Malware payload (AgentTesla)", "value": "bb318145703623f13e47d8576c05569a51408e8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512300, "uuid": "fdf983bf-b156-4f32-afba-0da95d1826b9", "comment": "Malware payload (AgentTesla)", "value": "920b97cba3bf8f9339f6e3ae81cc779adcee010a21ef5eb9096da982acdf15559122d50706839b3c18417ea04f66ac66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512300, "uuid": "eabfa5a6-2bc5-4597-8aea-a5ea3fe1b1f3", "value": "T1974423EE3362CA6CD4F8F0314364E9896D8F5C6076A717955B59C602EB3AD402F8E0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512300, "uuid": "95255efd-d9f8-4c44-b6c8-df7b6acb9880", "value": "6144:vjFAOBLb6MEclETCJBn0s85Kp9IxOvG1RDyV973v1uDQ115E2dU:L/BLb6MUwBn0sK+yxMoRWV9Tvb9EKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645512300, "uuid": "3b1061ea-7c17-43df-b475-afd4bad0a150", "value": 273914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645512300, "uuid": "f2d7b586-d674-48ff-9c27-e672cb7418ae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512300, "uuid": "a70c26cc-6c2e-41dc-8265-771ef623e24c", "value": "ArcelorMittal -RM679847650 RM634985744.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a99fd23-93e6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645537838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537838, "uuid": "02115c21-fdea-4d12-8b6e-fbcce60d0628", "comment": "Malware payload", "value": "d9ea030e883dc965b79ae76dfd5c70ac", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537838, "uuid": "051c3b69-9ccc-40e8-a513-30aafda47265", "comment": "Malware payload", "value": "100cd983ec6dc268900ab2d56587c03a2c7f6ae1e2165f7e35bcf2e7e4237973", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537838, "uuid": "e6057676-5efc-4ed1-a7c1-31d1a3054668", "comment": "Malware payload", "value": "4084c9c78bc98b6418473748c24b63b5ddc78a35", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537838, "uuid": "e138ffe3-9cb5-44bc-9520-691293148281", "comment": "Malware payload", "value": "af1b22ba2c19223e52a91c3ce5039489677721696116d375ac55dd7a05a0d8ba5634335214ad87058a029bafddf83f0e", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537838, "uuid": "d788d18d-2b8d-49e8-aec5-98535502ed41", "value": "T13F8114AE035FC9FCA6236CC885D95A57EBA94626467CE7C0DF607EFA241057CE0F0858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537838, "uuid": "ea163b4a-e6cd-4dba-b452-2848ca60c61c", "value": "96:h4+NEHtc2i5x/Ospgc9POxwWcC2Yr8qDlvrpA8/FKLgPQcQf:h4+etlYOspgc9PUwWcCLTp1FKLgPQcQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645537838, "uuid": "bac05cfe-604f-47c7-8c54-d43c3f8eb0f8", "value": 4159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645537838, "uuid": "3ed639f5-12c0-481d-a304-cb5a70a99cf8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537838, "uuid": "9c6d7134-0b20-42a2-b9bb-836e2a2eab2e", "value": "documentaz_190.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c59820-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517581, "uuid": "1639dc35-d914-4bab-8ded-83a8091b0908", "comment": "Malware payload", "value": "5c213f75b48d17941b8c7dc59af2660e", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517581, "uuid": "5793f272-a4ea-4169-a6ad-a2b00d773799", "comment": "Malware payload", "value": "1155dd06e0b108bde3addcdbd5d1da4dc18ca245c39ce7d967f8971eb0f88dbb", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517581, "uuid": "446bee6e-904d-4d88-8090-49c50af1ca97", "comment": "Malware payload", "value": "fcda21548bd4359aae49ffb6a9dab84286b4b7c2", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517581, "uuid": "e8e627f2-60f1-4b37-8885-666fe6595c10", "comment": "Malware payload", "value": "a316a0d157908058a877694e067d28d588f18bc7ef92ad2b6559877a8057e705857755429c16e491b460266f2b396efe", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517581, "uuid": "2cd30c72-be3b-4ec0-a109-24825985cdfb", "value": "T1E8F1F825F3E88A76D9BB0A326C7326400375F21B8D67AB9E54CA351F5C167040AA3F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517581, "uuid": "e58e52f9-bd32-4b61-a6f9-aba599526360", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517581, "uuid": "24d2242c-1528-4b28-b5b9-87e2b85a3e84", "value": "96:VaGEVeWjIq0Eg2GLolUD2Isf1KiFmZg3pUht3MzNt:VaKEl5qZs+gSrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517581, "uuid": "a1b5c438-0b44-41c9-9cf6-d2d2721a2da4", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517581, "uuid": "2f856f0e-7fa9-460c-942f-e355064d189d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517581, "uuid": "14ada110-2bf3-4116-aabb-73e3e2a1eabf", "value": "1155dd06e0b108bde3addcdbd5d1da4dc18ca245c39ce7d967f8971eb0f88dbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a886425-93ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645540790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540790, "uuid": "e0e4325a-c650-40bb-9a3c-3d7a6059edde", "comment": "Malware payload (Formbook)", "value": "aa4fef3a9f360a1ea3b5ab186a8a10ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540790, "uuid": "a70329b4-0367-4d58-8499-1012a0c0cb35", "comment": "Malware payload (Formbook)", "value": "11c1e5905566d8f30d8da73ce95e426fe6b960dae7e2852a0801297404d0d02c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540790, "uuid": "be5c4308-3670-4d73-a7dd-fcbb1eb1427e", "comment": "Malware payload (Formbook)", "value": "a5d137dd257a0545bc5cd3b3ba79dadb647b5c60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540790, "uuid": "92642ba5-5fd4-449e-b1a4-4b67c277da3f", "comment": "Malware payload (Formbook)", "value": "9a2bea998e03e67f21f029775ac3b9bc7b5f0335dd1b91f2c65fbd62640208abd1d897bf7d31a6fc2b4c1cbe76b635ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540790, "uuid": "fa6ef468-8642-4f47-8cb3-6eb194ad637f", "value": "T16534120D35C4D6DBC44182722A7B4B2AE2F69200074724DF6BDC6F7E6F293D3A11A697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540790, "uuid": "b586d78d-bf38-410a-84a8-f827b6b943b4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540790, "uuid": "c6920680-b7ab-45ad-b48a-c5bddb29ef5c", "value": "6144:TxDo+apSrtZHU5TdPPMxZ8P2zEchIMBG+I:KAxZ05Cx42z1hNBG+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645540790, "uuid": "38cc52fc-cf9e-4306-b9e8-9e7dccca799d", "value": 244447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645540790, "uuid": "4238e49a-a745-4f9e-a8cf-a5862a9678a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540790, "uuid": "7b0ba1ba-76ac-4624-9d5e-100c7be754bc", "value": "remittance MT 103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d48f9a-93d9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645532345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532345, "uuid": "346b2125-8533-42f0-8006-f04419cbef03", "comment": "Malware payload (AgentTesla)", "value": "ba364d8ee75b35ff2f83c82758df850a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532345, "uuid": "44915a30-120f-476b-ae0a-717707b625e3", "comment": "Malware payload (AgentTesla)", "value": "12237d541e69d014991e90122d8e7de36cb92de036e4524f282dc186b9f98166", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532345, "uuid": "53f13d6b-71c0-4d29-9194-0c9994242a0f", "comment": "Malware payload (AgentTesla)", "value": "05f73f7081c1a257e4e21f82d2dc86a24327873f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532345, "uuid": "76878964-e67f-4bc6-ae5f-e2541d5f784a", "comment": "Malware payload (AgentTesla)", "value": "6cd41f9a9dcdefc22ee0405006c1c9abd041a3c673900b708cd9147baee5b9973fdcf01008ac2c8c86ea382d95f52e6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532345, "uuid": "9fe7296b-b24f-40a2-855b-bea6ffb50856", "value": "T139355A9C365072EFC867C976CAA81C64EA60747B930FD203A05316ADDE4DA9BCF154F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532345, "uuid": "172bce2c-feef-4368-8a1e-06cf1864591d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532345, "uuid": "db42d0e7-1925-45da-b210-a7c317998f68", "value": "12288:+FBIEzK8DQ7ACcy6SbGxYbny+g55Uf3pHb0i3YC9p9UCC22J8aJtLPxrCnNlsIx1:mIE2yTMbnGuZ4ixUX8arPxrCn7SRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532345, "uuid": "884d32b7-3039-4a4f-9723-98aa126bf932", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532345, "uuid": "c5441376-2f68-43e3-a03b-eff03ceccdef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532345, "uuid": "2659b855-19f0-4c64-a570-7de39dbb67b6", "value": "Proforma Invoice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe69d22-93a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645510815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510815, "uuid": "61f34c2d-4c35-4934-9bc3-5908613c7805", "comment": "Malware payload", "value": "2b8c34d95efab926971d15fb3d5597f1", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510815, "uuid": "374906df-93d6-458b-8408-e1a0d4707a6b", "comment": "Malware payload", "value": "12b746c0b5556ef44be803c0ebb7dbfccbacd3a4f8df1b783d4730a311209cdd", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510815, "uuid": "b46baaff-33bf-49d7-96d9-d3e798b759f7", "comment": "Malware payload", "value": "1f90faffb3b9e845463ca9f258220c6d8c33a87f", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510815, "uuid": "34eeeaf2-4b58-46fd-9e1e-184a287b479c", "comment": "Malware payload", "value": "2f2406ab79d16bd8e98dfa4720b8977d25712b881a3b5d6cbd12dd18f474a4771212ab331422f155eab5c028900e86c1", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510815, "uuid": "503b7246-1a01-44d0-825c-13b2a6757067", "value": "T1A7C47E57F7DBF6B0E6FE827A86F1851C52B774620260A78F664072886D22392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510815, "uuid": "ea843677-b974-42c6-a195-3a18f46c3d1b", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510815, "uuid": "386c989f-7cb2-4894-9c4b-514c2cc834ea", "value": "12288:Un/zDvGHAykH8vLW/4+8bzbBSreMdsBY4ZyrE7K3yl8PeVooA/AB2LEJZWiAQPUG:2zbGHAzHKjX1HBY4ZyrE7K3yl8PeVoo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645510815, "uuid": "ca53d2e1-f125-4b4c-bc77-cd7541d8b067", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645510815, "uuid": "aec65e72-f66d-402f-93e9-b31ed44e88ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510815, "uuid": "fd322feb-fe90-4bf4-aeed-bdfa581374e7", "value": "company regitration.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502bd0c4-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517607, "uuid": "d412ad76-fe79-4250-a124-04b13f3e4ffe", "comment": "Malware payload", "value": "571648b47ff28fbe4ba17fae965829cf", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517607, "uuid": "95d0e91a-1522-4240-85f3-3c5dbf4be41b", "comment": "Malware payload", "value": "13a016b8f502c81e172c09114f25e4d8a8632768aefd56c5f6d147e9b6466216", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517607, "uuid": "f2232806-3eb8-4e0d-9cbd-11747275bc9a", "comment": "Malware payload", "value": "eea69a3efb1196f4aae3daae0c5776b485a75d23", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517607, "uuid": "12619938-beb9-49d4-a9cf-c0b073213e15", "comment": "Malware payload", "value": "43436413bb5d13681922a02fcd849c12e71b4bc22a761d990592e440b4b26b165c577cab28d5bfcf50054b6dad97d1b7", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517607, "uuid": "07e6d199-000b-41b8-8379-0e539d1cf5ca", "value": "T198F2F91A37EA9B74E2FE9B7CACB36100057AB90B8411DB5D1CDA108D09B7B845D62F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517607, "uuid": "a87c1107-f3f9-4178-a814-621da69ba693", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517607, "uuid": "c69ce295-8c2e-482d-ad3a-b3673f01e285", "value": "768:F9hI7sMn0VqRmstSX4c18cXDAh7TDekXcq/MV:F9hIqoxgcdDekXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517607, "uuid": "e9abed99-8f83-4f01-8813-7b5e3e35e411", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517607, "uuid": "2004dfc0-e4f4-4d93-a242-4e601fc8db2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517607, "uuid": "07b1cfa4-6f2a-41c0-86df-509a306fa07d", "value": "13a016b8f502c81e172c09114f25e4d8a8632768aefd56c5f6d147e9b6466216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a1a678-940c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554281, "uuid": "64d2f8f2-9f9f-47b6-a891-bb2d50e194fa", "comment": "Malware payload (Heodo)", "value": "ef1d3dc15f61d5401f7e4eb2d98bbee5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554281, "uuid": "0ef2d9f8-285e-4f8f-9c86-a25ecdc7a7d1", "comment": "Malware payload (Heodo)", "value": "13fc82c0d73fbf12dd8fc3583ffece7efc30b6cb07405b934576effbf10991a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554281, "uuid": "3703eb3f-7c33-48d1-bab6-1a5e960afa4a", "comment": "Malware payload (Heodo)", "value": "394730766c40b79f9dcc98dbd33b69b8b6d5fba3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554281, "uuid": "5568c1a0-8b11-499a-a50d-ac3734be04bf", "comment": "Malware payload (Heodo)", "value": "8ed4223c9ab5f36e36dc4833108b33d6b4c12ff1e917be0f9d9acdb80f6aab09d05df7e89858954a4b33df24c26711ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554281, "uuid": "5c912277-a253-4407-8f1a-dade3633af70", "value": "T18DA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554281, "uuid": "335e8722-a36f-42fa-a6f4-ac51ed047dcd", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554281, "uuid": "0da9699f-5179-415b-83f2-8f1d71f69cc2", "value": "12288:vicw4w2Vb0zq6k5Z2mTujqkGXNrGHORQuBT:viSwub0W6LmT6wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554281, "uuid": "d8195dc6-8771-47ee-a9f4-4f40c83d9413", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554281, "uuid": "68c45656-d31d-403d-a91e-0234e2cf29bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554281, "uuid": "5608cc86-0e4e-4a15-956f-21165b0a7879", "value": "ef1d3dc15f61d5401f7e4eb2d98bbee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c421e5-9402-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645549847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549847, "uuid": "2c60a805-1c53-4744-8bcd-4f26671c1681", "comment": "Malware payload", "value": "a286e652565dc7fdf8cf50da05fd19cc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549847, "uuid": "05bd9d11-1a7d-4818-89ab-ce42d12f32e6", "comment": "Malware payload", "value": "1408fdeb90a9d5f0e36854f625f411431e1f552f96b66432971b81356e5e3459", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549847, "uuid": "497ced39-26d4-4bed-be4c-06f1afb78cc3", "comment": "Malware payload", "value": "373325d6d45b8119068c5d463681835286ea1cba", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549847, "uuid": "dd489d97-db61-49f9-940e-c61ab667eb48", "comment": "Malware payload", "value": "36d3d660c386adeed8e9fd943c5a1bb9afa0e9a9b796513303b9bd9046fd070e5a31d78c8b5d5642a8d9cb775c670c24", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549847, "uuid": "d8a33282-1485-49cb-ae64-68900bf93447", "value": "T18693F769B681C95ACA5807344CD7CBF67327BC424E7987873298F32E2EB7650DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549847, "uuid": "f9bfc015-557a-472e-a275-e8ae720c1b92", "value": "1536:9yehv7q2Pjx45uoDGTj+5xtekEvi8/dga8EsAeE9jbDXQb2kWvgrPE4nWHPNc2At:9yehv7q2Pjx45uoDGTj+5xtekEvi8/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549847, "uuid": "34ccd90f-30f3-4363-87db-0b1c1d552f39", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549847, "uuid": "082fb9f6-f02f-45f9-be5d-ac6c86da9cb3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549847, "uuid": "168449f2-bea3-497d-9ced-73b7cc02e6fc", "value": "tmprwmt6bba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12668c98-93d0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645528241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528241, "uuid": "74c31f01-f2e4-4bab-8526-42e03358310f", "comment": "Malware payload", "value": "c106cbab93f27765927051c1c5800378", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528241, "uuid": "73467777-e895-4739-87d6-1b006187da41", "comment": "Malware payload", "value": "143814e133b03906538666133be4e45cecc08112cd00496525449e67ae9c0a00", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528241, "uuid": "bda8e12a-7325-4f6d-a667-8826e8401bd7", "comment": "Malware payload", "value": "3d8003300963115aff706df96ef6d463d71c1ffa", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528241, "uuid": "52dd0e02-b33b-43e1-9fb7-b8e63d591202", "comment": "Malware payload", "value": "da90e05245fa599edfa77e4a07638aecb0e5df9f05fdd0e8b8129af5da22812fa439ed78ad5beb22b9412c95ea7e7c90", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528241, "uuid": "31208020-7366-4d8d-97f7-89274aafb83f", "value": "T1AA5110903C95D9DC136A67B2946E5801E07392E2BD80D141E184DCA27A54B11CB7EEB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528241, "uuid": "778dd495-309b-479e-bd85-ff2c1d0c622a", "value": "48:toJvAnH8ykUFrgv+gcie33R5c5fhTvIJKcDvI2EtLcBN5x9FLc8ciNcKUC7:fnc/KPgci03RCfhTgJLgFS9FH3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528241, "uuid": "07bb4967-a74d-4506-acee-6d463b054b62", "value": 2777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528241, "uuid": "32b1b8eb-6bd5-43f8-8cd2-9dd01229aee2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528241, "uuid": "6b611726-6eff-488f-84af-fb3a778d39d4", "value": "23.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b058d52d-940c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554276, "uuid": "d3c88259-6b77-43af-8aaf-33bdfd4ade62", "comment": "Malware payload (Heodo)", "value": "ffe852a09fe38d3d629a062c71487312", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554276, "uuid": "904c6e98-55b4-4c0a-839b-5f9ec02307ef", "comment": "Malware payload (Heodo)", "value": "149cadbf32b894bffdb5035e9a565e3cdae90f85ce6fc828810df739d574dbf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554276, "uuid": "0d2ba772-7e07-45ad-a0af-76e12cd3b975", "comment": "Malware payload (Heodo)", "value": "f098a976b3dcd229a66a9f060277cc914e1a6267", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554276, "uuid": "7e701f94-b572-432f-bba6-b6915d66fbb9", "comment": "Malware payload (Heodo)", "value": "0fe6b8ccfa32884b13d359a19ede4af491f0a170580b60288146da16c2f8cc254462161adae8730626234d2690e0639a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554276, "uuid": "4563253e-d5a4-4d38-9af0-ce8c36f0efaf", "value": "T13DA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554276, "uuid": "233a3ac4-5c70-4d5a-933c-3ce11d611cb9", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554276, "uuid": "234dfcde-4f3c-4776-9805-1805c0ffe696", "value": "12288:vicw4w2Vb0zq6k5Z2mTajqkGXNrGHORQuBT:viSwub0W6LmTOwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554276, "uuid": "000a89c2-e8d4-4304-b676-b7ddd50fd33d", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554276, "uuid": "d335054f-b80d-403d-8b88-16d5958bcae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554276, "uuid": "63df70f3-8e4e-4734-adc9-9f3a62219de0", "value": "ffe852a09fe38d3d629a062c71487312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684133b2-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517647, "uuid": "030ebd1d-1281-436b-a7de-2afea0544139", "comment": "Malware payload", "value": "316597f4cac84abecd908ac0439d8c90", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517647, "uuid": "ea5c9808-27a6-401b-93c2-c6d13f4e7812", "comment": "Malware payload", "value": "1607f31ac66dfec739dc675ade921582acb8446c2ac7d6d1bc65a3e993fc5b54", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517647, "uuid": "125ad255-a2f0-4e57-937e-048f1c334c48", "comment": "Malware payload", "value": "54b1feb595f01c08e38b872b77ca38833f4bf309", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517647, "uuid": "73a4212c-70de-4542-ba3b-606cf2ec4e61", "comment": "Malware payload", "value": "0e84cd38d0b890cec651c03dd7be6e7b5ec4e48e52ee4cf02ae862dc018ce82f3f8317a3641172c0080b808452bd80fe", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517647, "uuid": "8af4c9d0-451e-4536-bf99-6dacc663fbd9", "value": "T1F9F4383439EA501AB173EFA68BE479EADA6FB7733B07645D109103860723981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517647, "uuid": "338d8ef6-7d90-4075-8796-0d922e79fb61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517647, "uuid": "6e3791c1-124a-44a9-a0d8-9c1247d3e919", "value": "12288:xnkRdtjxoKXB3/WIavfVofPhGWvVq0Cyjru5WNgQuDNkct6qk9WM7skFB5l21ls9:utYxkBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517647, "uuid": "b37cc679-ff59-4ccc-a48f-b6680cfa6929", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517647, "uuid": "4ba3d102-0077-4835-90e5-03572a6b5d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517647, "uuid": "2e3074c4-c628-41b4-b043-c8cadbd5eb94", "value": "1607f31ac66dfec739dc675ade921582acb8446c2ac7d6d1bc65a3e993fc5b54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bf06d6-93bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645520267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520267, "uuid": "8f58fc32-b75a-4e9f-846b-947baa983303", "comment": "Malware payload (Loki)", "value": "8cd0c06a70a994b1fb3052be24afda9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520267, "uuid": "c47491c6-ee67-427e-8624-506a6056abdc", "comment": "Malware payload (Loki)", "value": "17537822450bb11f587944ee0509e308fe9935888ad7254960ccf7269a3bf476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520267, "uuid": "b8319501-5360-4060-b8c4-3e7b84916794", "comment": "Malware payload (Loki)", "value": "307001ceabfbe0ba031a06c8059c1b2c0a245aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520267, "uuid": "545daee0-8e3e-4ef9-84f3-be5cc6933b69", "comment": "Malware payload (Loki)", "value": "fcb44111ed7ae48c0c667b997e3d913ccf128ff85187c9e6ab8930be5648aaad537fc5776ce9c27f40d8eae0e7cc4ecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520267, "uuid": "820a2cb0-fad5-49ef-9c5c-ca17667e77b4", "value": "T17834132F33E0A8F7DC5402F064BFEB1987F796002BAA1D8B2B494F7A65184937905767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520267, "uuid": "ad20b823-3be6-4a94-8f6f-57beea67d675", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520267, "uuid": "06a6f2d1-daea-44d4-8b52-715214f3b3f2", "value": "3072:Tx6UW6tpmJc0ecxXkvQj/W4ks3nmn6k7/HhkrVKCnrjZWobhtF/dD66OU/Viq9En:TxDwe604Uso6k7fh43NdVDgQV2j/p1/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645520267, "uuid": "2e23081b-3931-4f44-9426-03deb877c24b", "value": 233777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645520267, "uuid": "2484958b-9650-4c2b-8fe9-9c1e1d8f7fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520267, "uuid": "745f5ca1-00f2-48bf-8e1a-4ad9c7e0c75f", "value": "win32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda58bc9-93b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645515321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515321, "uuid": "d259fd6f-ad9e-402d-b926-29a30352cd7b", "comment": "Malware payload", "value": "d5b4f203971524679b115550e2f01758", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515321, "uuid": "d20c9db9-c68f-44fc-82a9-830d16b7f7f0", "comment": "Malware payload", "value": "17985efa720c6ddb215f0593003c3665290ab48aed0702be6c3a1cdd145759c2", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515321, "uuid": "be75bb3d-33f0-4e6d-b1b1-5ad3921b5516", "comment": "Malware payload", "value": "1536d8fa9cd45ccb91afe8d8eac983ddadb9ca15", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515321, "uuid": "9d27d22a-a734-4672-9326-406bf01628ed", "comment": "Malware payload", "value": "bbc6c51ba0e07d52921fb3ef5c9362368c3d29d18ad0340804a064766f8a068d14f962735fbb5a6c7bbccca47a12c458", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515321, "uuid": "541441a1-e20b-431b-a85d-bccd3be52e83", "value": "T16E23C01CC5005647C673693EC47988E11AABCC53B11449CFD2EA7F8B0B95E962B8F7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515321, "uuid": "a26ca6e7-b8da-47e6-864a-471bd5b19792", "value": "768:3+LHRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnG:3+9JqHt7NJECQFfqA7YzctA1/K8Nyts/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645515321, "uuid": "5005be7f-b718-4743-9a74-f3c6472b0a74", "value": 48025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645515321, "uuid": "88a71853-327a-4521-915f-0ee630e756a3", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515321, "uuid": "db8b0955-3dcb-4cca-887c-6fad6c98b392", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aacd082-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "08c90eb0-e465-4f3b-8364-fb19b509bf40", "comment": "Malware payload (Heodo)", "value": "35bcdf63d2497aad855ec4e52c177d75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "b20bea62-3558-43c3-b4fa-a8f9fe46d310", "comment": "Malware payload (Heodo)", "value": "18523d8d2c155f96037fded23db475d574a20efddd5d707708cd1aefeb2d3519", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "d8515b6a-60df-45a8-81fc-cdba684d3d8f", "comment": "Malware payload (Heodo)", "value": "419b970b667b734d718ff0aeeacea8f3dd39302f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "935aeeec-1131-4419-95f1-c2e28c179e34", "comment": "Malware payload (Heodo)", "value": "bc78580ba097c3d8e9ba0ffa6e989add620ef3a42c82c9482bea03c32046a50afcb6b19b1e7902cc168bb7b70b9abffe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "f56ab301-4769-414f-b762-f2d63d31fbff", "value": "T16BA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "2169ace7-084f-4b6d-bf8b-919b9ee5a7ae", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "1072553d-ebdb-4688-a04b-3983529315d4", "value": "12288:vicw4w2Vb0zq6k5Z2mTpjqkGXNrGHORQuBT:viSwub0W6LmTvwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549944, "uuid": "c042db02-fb7e-496f-b025-a863a9fec81e", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549944, "uuid": "4ea8310f-46f4-4f80-8b18-126756f4e551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "029a94ca-27a3-4146-a3ed-edb7ca9b061c", "value": "emotet_exe_e4_18523d8d2c155f96037fded23db475d574a20efddd5d707708cd1aefeb2d3519_2022-02-22__171219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b971e68-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645538994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538994, "uuid": "ea0036e4-cbb5-4a42-8368-0934a814612c", "comment": "Malware payload (Formbook)", "value": "e56926dc82f374200bdc1b2640803565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538994, "uuid": "1eef2614-89ae-410a-aa66-575f205d95fd", "comment": "Malware payload (Formbook)", "value": "1900d46bb03d8aeb4a1bfef16cd5b45903dc56c89b0dc7784b45c89f17a9f895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538994, "uuid": "d35bd716-4f67-448d-95e8-14c39d83fc70", "comment": "Malware payload (Formbook)", "value": "8cd2be38312ac4074411d92163fb72ff2c78eb0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538994, "uuid": "b984008e-06f6-4624-ad5e-3b5b0f313a55", "comment": "Malware payload (Formbook)", "value": "33cc266f23b7b1eac8021c9108c5eaf06bdb81a2d500a19cc60098107ce3265711458fc05f5f06c74af2a6b5ffcbe5be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538994, "uuid": "9523384e-109c-4b3b-b494-e3842bcabef9", "value": "T12E34120B10D19CFAC219563017FAE5DAABFBF23A87251287AB701F9D6C155CE820C5E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538994, "uuid": "b7adc3f8-61ff-4307-ba17-6d62cf43da72", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538994, "uuid": "fa967d63-1962-4166-b384-eeaac46e259e", "value": "6144:TxDgFYjqmBlf8uoP+bvwJj1N3JpDkwIxhCZ2nyOrxR8:mFIbDPoPwIZtIxwuyOrxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645538994, "uuid": "0f5a2616-2d60-477e-bc15-d8c3b3782df0", "value": 242366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645538994, "uuid": "874d2c5e-9bbd-4db5-834e-28d51cb1faa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538994, "uuid": "a075bf68-001e-4015-b100-5a1d4a7b5820", "value": "Awb_shipping_BL_doc_5860000000000000822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44702c16-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554954, "uuid": "1a459f3c-4a74-465a-b652-fca3d2406991", "comment": "Malware payload (Heodo)", "value": "79f0ebdcc097af91a5d19b0abe2e2728", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554954, "uuid": "0445c4cf-3aa2-4941-af75-a51a989c9208", "comment": "Malware payload (Heodo)", "value": "1911387f6a4af6f2f05f06637f27d4b14bde5f7bdbdbd1e18bd3e2a0fa7fa06b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554954, "uuid": "c88e3e3c-b71e-4ea5-9ef9-0340faddd8b9", "comment": "Malware payload (Heodo)", "value": "2fda977975345613aac1d999021a4b5df25fad5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554954, "uuid": "9dc738c4-5785-4295-95a8-b98583278a6a", "comment": "Malware payload (Heodo)", "value": "2aba3d036f06a7469224f02832b0b564f91f67081762cd5db18aa9ded8ae19a326ba48bb40f8ee3e51753079d752301d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554954, "uuid": "a5739a99-d034-482a-b4f0-f7ea1b24b02e", "value": "T11EA4AE21B6D0D432C26E30747A16E2B15AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554954, "uuid": "a73cbadf-9fd7-4ada-9540-a4ec643dccd0", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554954, "uuid": "9ac69c92-56bb-4fd6-925b-a3605c3ae072", "value": "12288:vicw4w2Vb0zq6k5Z2mTMjqkGXNrGHORQuBT:viSwub0W6LmTcwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554954, "uuid": "3154f5cf-74da-45eb-8585-06cab5821b96", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554954, "uuid": "8312f96b-6d3d-4d17-ae7f-2a63c64bbd18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554954, "uuid": "9921560a-3d47-4490-a9fe-d3028e967434", "value": "79f0ebdcc097af91a5d19b0abe2e2728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed45bf8-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517551, "uuid": "12595143-fe09-42e4-a326-cfcb8b13bf0c", "comment": "Malware payload", "value": "e7e0a94b702c839926926cf01bd53208", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517551, "uuid": "8ec0e67a-ea56-4f49-a2ca-5d4941d04f14", "comment": "Malware payload", "value": "197f13580ec249fa84b1e54f978c5cab60f22561a2fab2ff60bdb2d5bfa25512", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517551, "uuid": "9066dc5b-782e-4adc-a073-3be230dff85f", "comment": "Malware payload", "value": "892cce15e12de6e1720bd4afab6108fc9cc09fb9", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517551, "uuid": "45af75d2-4d75-4f1b-b1f6-141ea2b2361c", "comment": "Malware payload", "value": "59ebb6822b4f9310a610642f93ee96ccf7f7cda5c4d6bb37285e80d68107224104d7446caa743826c8f8ecb80dc89f2e", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517551, "uuid": "ce04d8c3-41fb-4284-94ab-a941c8e6edd7", "value": "T1B2B0920ECA4AC1C0A8103C4C4B8E3BC49806E49A831A4D44CB4A03BA34468E7905DBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517551, "uuid": "917d5688-0be2-46df-84e5-846c264ad93f", "value": "3:mKDD/W+IkI2F9XcXZjCxqjdi7XRF7BN:hSqBEsojdiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517551, "uuid": "93a0a509-c60d-4452-8730-546fd68ed36e", "value": 119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517551, "uuid": "fd2d5f98-04c7-418b-8801-61c732fc2506", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517551, "uuid": "69b4f2d3-82a8-4db5-83ac-f1de81ae424b", "value": "197f13580ec249fa84b1e54f978c5cab60f22561a2fab2ff60bdb2d5bfa25512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff74d42-93d2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645529257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529257, "uuid": "9f117d4d-332e-4cff-af51-3aa5f62e0d24", "comment": "Malware payload", "value": "ec420ed1149e0a1b7aced597fa8db8a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529257, "uuid": "47c13720-01b2-4ac9-af37-442701fbba42", "comment": "Malware payload", "value": "1a2274608ec4a96c703652359f9147d5e214d9d361dce25a6b669ca562bc9bdb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529257, "uuid": "b9d60d1c-315a-4cd9-9be7-af043298dc7a", "comment": "Malware payload", "value": "fb5cde74c685d1ce61cf5672962d230244369bf7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529257, "uuid": "d913ba96-dc58-481f-9863-2ebf79beb2f5", "comment": "Malware payload", "value": "a59ae51d8067d33031043201e4d0695cdf1fc0a110a4c5cdb58d482b5d1ef9cbf4844f4965eace2d920c0f93c27821ba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529257, "uuid": "9a641068-9032-484f-98ce-f26749ed9a9a", "value": "T10CF43319D8B2A881CA97353391704F027D4DE40DC457ABBB90A9FBDEA576BF04A00DF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529257, "uuid": "4a98fb2c-fa57-44a4-82e1-9477c5e26d9d", "value": "12288:lnZc/sLQDRXr0jnLCgVvnlPiJfjrvoPKLxHxYISaAsETsi/t6JqArpfpS:lnZc/sLQDRXEnP4fj71HxYIWfvEqEfpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645529257, "uuid": "d3495011-05d7-4022-be9b-5dd72dd52180", "value": 781243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645529257, "uuid": "c21d749a-78b8-4b0e-8f0f-65e8b88aef93", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529257, "uuid": "7f9a6eb7-4f84-4779-a244-53ec22616ea1", "value": "1a2274608ec4a96c703652359f9147d5e214d9d361dce25a6b669ca562bc9bdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914959a0-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555941, "uuid": "fc5315d3-d810-4367-8a61-f163ddc2f855", "comment": "Malware payload", "value": "45e49c0baa32799b15259b3367e58770", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555941, "uuid": "9ead763e-33a8-4e23-a196-d5a11973beaf", "comment": "Malware payload", "value": "1a4aab60991ee4bc49806f33a46c84aec14ea2efcc1b554a1f4766a88c7ca7d3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555941, "uuid": "4f6a769a-b12a-4c66-bb11-06720266b6a9", "comment": "Malware payload", "value": "535f7fc9f4f597824a4dca38e141f6f67d6cb22e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555941, "uuid": "eeb61370-39e9-4609-b8c1-6c1c90216e52", "comment": "Malware payload", "value": "1beb5b1fc6f32f9c466b6896990e31650bf378377920639eaa53e8f381be2a80b2c47bcf73bab5ccb05261a9988c83e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555941, "uuid": "848611be-4c33-46f3-abfe-6977094bbf79", "value": "T1B3930769B681C95BCA5807344CD7CBF67227BC424E7A87473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555941, "uuid": "42ab4ad2-1bc1-4ce5-a513-c3eaf5ab6ae8", "value": "1536:nyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAekWvgrPE4nWHPNc2Ap:nyehv7q2Pjx45uoDGTj+5xtekEvi8/d+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555941, "uuid": "00e078ac-7e8b-4b6a-872e-3a79b3933f2a", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555941, "uuid": "febad579-71b0-4008-a4b0-4debbb3b3b34", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555941, "uuid": "609a4aed-9fb7-46d1-bc2a-e900717fcf9c", "value": "tmp6qg7lyj5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733be23a-940b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645553744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553744, "uuid": "2fbb83d3-26e7-46e4-93ed-6310729599ae", "comment": "Malware payload", "value": "23a3aaee8a02cf1ed5f3e1a731efcd0d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553744, "uuid": "120b705b-0982-488b-adc0-6b294f145452", "comment": "Malware payload", "value": "1ab2f31fb0b73d7c82f3bf340a1dcbf80e5b0855ffe0d8052a74154656dd18f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553744, "uuid": "f572753c-7097-4b6e-bf41-0557a8f099f9", "comment": "Malware payload", "value": "0c78bf0d6ceca0e2ca45eb426fdf4d56b092ebb6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553744, "uuid": "0758f0df-8e0b-4d69-8ba8-58a86dd49515", "comment": "Malware payload", "value": "5df3aa27c81f71083e41b45e44e908c15bb7eed8935e630eb30b4825be7ed645104bae0bfdef0077f8ee04ec30649a56", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553744, "uuid": "d5b151af-5e7e-4d49-afe7-313e515df3b1", "value": "T10A930769B681C95BCA5807344CD7CBF67227BC424E7987873258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553744, "uuid": "045622bc-2cc4-42d5-a15f-13041a6f84c3", "value": "1536:Dyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQsakWvgrPE4nWHPNc2A9:Dyehv7q2Pjx45uoDGTj+5xtekEvi8/de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553744, "uuid": "6d446bd9-5e1f-4fda-a527-1904f5850436", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553744, "uuid": "0fb6dc7c-823e-4cb6-a92e-c0dc99568016", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553744, "uuid": "2c37a46b-8e48-4416-b894-499a898e8329", "value": "tmpcuow8m32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f96508-941f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645562358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562358, "uuid": "538076ba-7403-4b24-b324-3d6cc43d469c", "comment": "Malware payload (Heodo)", "value": "f37c37975778a2715ccc81efbeb93873", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562358, "uuid": "f68ec92e-7adf-436f-9435-db854018724b", "comment": "Malware payload (Heodo)", "value": "1ac0905619b466a82d6e0546ee9719d289a19207aa43d1203a604b253c212a7e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562358, "uuid": "4a53909e-40ea-416b-bcbf-241a829d1d58", "comment": "Malware payload (Heodo)", "value": "ea2c7f964caa195c5d2f40a5886d32c88afdaaff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562358, "uuid": "661fb5f4-5a85-403d-a342-51960752bf36", "comment": "Malware payload (Heodo)", "value": "9202474c71d254ac62f30146fd06209b9db07369714d4eb8130891e7ab69385f88e9f503661e910b883bff23ac17b60b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562358, "uuid": "507231f4-d1ea-4324-aac3-27df1cfe06c5", "value": "T18DA4AD21B7D0D032C2AE31746A16E3B56AADB93099F592477FC40B7D9F351D28A2834F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562358, "uuid": "797f6a4c-7154-4be1-9690-8ae40fb3d395", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562358, "uuid": "b76d4b76-f241-448d-b598-18cec01edde6", "value": "6144:PFdhYCryBe9NY/55YWAVtXWUVPlLX8IjMpz5yRskIpqAiA8KQd5dhMYi7nwZJjIF:dPY8Y/7nctXWUDIpz5GsLH2fTSRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562358, "uuid": "2cd6a685-8f2e-4378-87bb-a00897ad65b0", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562358, "uuid": "d889e5d9-a637-454a-99b0-200370faa798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562358, "uuid": "33111ba9-e972-4428-90b8-3ebb71a9d15a", "value": "emotet_exe_e5_1ac0905619b466a82d6e0546ee9719d289a19207aa43d1203a604b253c212a7e_2022-02-22__203914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cf5959-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645556048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556048, "uuid": "3d527115-2b68-4acb-9ba4-ee6451845542", "comment": "Malware payload", "value": "1ca2d431085aeaf74a34fa288ee241ce", "object_relation": "md5", "Tag": [ { "name": "NW0rm bat", "colour": "#05E7FF", "exportable": true, "hide_tag": false }, { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556048, "uuid": "4c060af7-5a5e-41f0-bd47-78195d9942b4", "comment": "Malware payload", "value": "1b14dced54fee58bc9101ae0a0d99be3d8e5ec293937f25177acc12d1775d764", "object_relation": "sha256", "Tag": [ { "name": "NW0rm bat", "colour": "#05E7FF", "exportable": true, "hide_tag": false }, { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556048, "uuid": "e00de4b0-6309-4d9a-8528-53311ffcf6b0", "comment": "Malware payload", "value": "c2eee8833239a4f314c788974cd918458213d2cd", "object_relation": "sha1", "Tag": [ { "name": "NW0rm bat", "colour": "#05E7FF", "exportable": true, "hide_tag": false }, { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556048, "uuid": "ebe3b584-a0d8-43ca-84d6-345af2eeb335", "comment": "Malware payload", "value": "028ddfe08850a2a9d46ae2e49211a5c84c23f0de1e5c6dc4a78e0a3b01f1bac830f2db387f3c5010f9ff464b713292ba", "object_relation": "sha3-384", "Tag": [ { "name": "NW0rm bat", "colour": "#05E7FF", "exportable": true, "hide_tag": false }, { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556048, "uuid": "ec0c9c28-a3f6-4d7b-81e0-82dfb6e24879", "value": "T124E02B43C41E8326B253C46EC1A044E6E5C790FC6E5289B9B96729A70DCAAB1D4282DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556048, "uuid": "461b7697-fa7d-4612-9c73-359bb14dab6c", "value": "6:hZnqhF4H5mk39v0LVFAg1nFIb1pc4jaVJW85s3oJowN:rnqhF4H5mEv0J68ybfcVqKo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645556048, "uuid": "651798bd-3cf7-4e0f-95a4-b10bebbabe66", "value": 292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645556048, "uuid": "a6d9612e-9aa9-4d8a-ac3c-e7d765636b2f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556048, "uuid": "fa10715d-ada1-4529-a9df-120a99a24b40", "value": "LZAVOBYIRFWZQZVCTGHPQB.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aec5659-9412-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645556763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556763, "uuid": "5dbabc2b-f62c-4c15-a73e-4070bae20ac9", "comment": "Malware payload", "value": "fa584c2b021aed55aff0c764aee1cff0", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556763, "uuid": "15b86f58-b75e-4685-8330-66a809f36494", "comment": "Malware payload", "value": "1b956ea6626165956ea897d431801376e7189f96e149de1b2ee2fed6944a38b2", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556763, "uuid": "6f1e3c7b-90d5-4d38-99bb-1d6278a38998", "comment": "Malware payload", "value": "327e83c2886c42896804ab87ca6996cb621e9b71", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556763, "uuid": "9714ff06-6895-46d5-9c06-4bb5d6ea5fc5", "comment": "Malware payload", "value": "92f2182a5a03d3180e3a79ea444390808d0fe9e92f3efcc0125126982b7d63750f937821137a0a16592b1518ca9b2887", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556763, "uuid": "43c9d4ea-6ea9-41dc-917c-9e6161d70498", "value": "T1B171A374B0247AF38D02BD29D0E891731E7334345AFBA582882106371EF9DBA27DA247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556763, "uuid": "e63c52f7-cfb9-4651-a955-7782e1168c0f", "value": "96:JRrjleLz4IYOINpCDwk/pKI7Y/j+hAderriwx7QkquS/:Llen4IYOsEwk/pIChAderrvx7QkvS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645556763, "uuid": "45e58214-e95a-4659-bbe1-c52858031300", "value": 3775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645556763, "uuid": "1c472a59-27a1-4117-8dd1-910ed86bb9db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556763, "uuid": "82f5806c-9eb4-4213-8ad6-8a03c6537a4f", "value": "EncKAO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5a3411-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518270, "uuid": "390a3a04-e688-4f67-b3d1-1a4f43410a8a", "comment": "Malware payload (njrat)", "value": "101a1c9a3fe3f50ced05b7204baf517b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518270, "uuid": "1123d3fb-a6c3-4701-8034-55738eab15ae", "comment": "Malware payload (njrat)", "value": "1c045ca8ebd2cfca8898883aec510da9b67fedb0e0db31000e1b123f846add37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518270, "uuid": "f9469f65-8c7d-4f0e-ac2f-424b15040d7a", "comment": "Malware payload (njrat)", "value": "d006023fdfebbb4d1de64ccebffef6186c29331f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518270, "uuid": "5805df1b-9c09-427f-b7ac-b49efd08c9c9", "comment": "Malware payload (njrat)", "value": "5eee1ae3de7bd57447af7fa0263cdf0a0f3ba6a0ffcf829cf50f6f3698d65dce8b90859d982b5bacd35b65472fa9f31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518270, "uuid": "950c69de-7a8c-4fb8-9bb0-1cf07c4bf169", "value": "T10A033A4D7FE181A8C5FD067B05B2D41207BAE04B6E23D91E8EF564DA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518270, "uuid": "aecf9a5b-9294-478e-90ff-44f0f8097091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518270, "uuid": "d453f66e-d378-4c1c-894f-268af63f37e6", "value": "384:AKjoUiFebK7FmpE8QyEfuifpefHCwSrAF+rMRTyN/0L+EcoinblneHQM3epzXoNL:Jt2n8LEfuiAvCzrM+rMRa8NuKTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518270, "uuid": "af24e34f-3d25-415b-b10e-4c78d5a7c890", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518270, "uuid": "9083205d-ac77-4c32-aaca-f97ba2f3b347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518270, "uuid": "e0a04ca1-71d2-42b6-a76b-198f1c200cc4", "value": "101a1c9a3fe3f50ced05b7204baf517b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54496c01-942a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645567006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567006, "uuid": "d75b25dc-6177-45f1-9a2e-5b64e12ce57c", "comment": "Malware payload (Heodo)", "value": "ca05f4ec28bd0c61842d7bb4923f768d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567006, "uuid": "02eafe85-4250-46ef-bc52-f012300c52f3", "comment": "Malware payload (Heodo)", "value": "1ce558c397c6369e587e3b3f16eb6b2daa92d760cd7a1f642f8a87c55fc46ac2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567006, "uuid": "64a2b873-e896-4db0-97d0-7f7a2e7770e0", "comment": "Malware payload (Heodo)", "value": "582ad0ffcec67ca964978d6f931daf9c34750cb9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567006, "uuid": "35dd4d60-6ec5-4771-8e4e-77e83aa24e5f", "comment": "Malware payload (Heodo)", "value": "097738974de6b3b7c631b6c8c4c1632971f312c5602a59a6255df69e66fb896206e64e79d23c2d54f907f5ca6b54c17a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567006, "uuid": "8c7f0146-7ed3-4d1b-84f5-6686258ec7a4", "value": "T151B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567006, "uuid": "1a8d04a0-06a2-4524-b6b4-d4e317688894", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567006, "uuid": "7acf581d-795e-4467-bac7-cfb94b15c40b", "value": "12288:IOzyEtBX2ZHq79++6/G5YgvmgZDa6A9TU:lnmZKR+OYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645567006, "uuid": "b12da2d5-caba-4d10-9037-8022cc77ddae", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645567006, "uuid": "fe516dfc-12a2-4ba7-b8d1-61cf30320599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567006, "uuid": "7eb07394-a5c3-41e8-80ff-e4daaaaf3f5c", "value": "emotet_exe_e4_1ce558c397c6369e587e3b3f16eb6b2daa92d760cd7a1f642f8a87c55fc46ac2_2022-02-22__215641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1b717b-93ed-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645540716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540716, "uuid": "87b89c2b-3936-44f6-b8de-cd69fc906317", "comment": "Malware payload (AgentTesla)", "value": "66ef37ae0c87ec5f2781b12a5a0ca56c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540716, "uuid": "58418638-4c02-4f3d-a88f-8c77c32b45c3", "comment": "Malware payload (AgentTesla)", "value": "1d1d200ab7d8132cf81482268afc8ec1b03803289e263154bf353d45ec3f1f54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540716, "uuid": "3e8016c3-a7d2-46b3-b4db-e2ece6684730", "comment": "Malware payload (AgentTesla)", "value": "e4fb2b655eaf2cad2ed73b159c467d391cad9082", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540716, "uuid": "70555d3c-d814-4fd2-9105-036b669b7f26", "comment": "Malware payload (AgentTesla)", "value": "12ae0df18858d3939cdbd198e58712ca3fb93acdacdad29963802c4408a3bc47c3fb09858f5dd24ad0104fb83e2f5caf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540716, "uuid": "4ecd7efa-82a1-4170-9457-c5282ce15047", "value": "T125355A9C365072EFC857C976CAA81C64EA60747B930BD243A06316ECDE0DA9BDF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540716, "uuid": "2840eb5d-e597-4f5d-bb1f-f54674131fd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540716, "uuid": "691f0384-75b5-49a8-832c-a447b8eda5c1", "value": "24576:4SVozc2TA9egG64i78QwOJdPIti1UWw1q7XTEgXO/1QVe:4SRx9k697PiNWqyXTfe/14e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645540716, "uuid": "9768390f-5e8e-4755-a1e6-ad2a9c7d9897", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645540716, "uuid": "57e4b5dd-f495-40d3-8776-48f7ccdca201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540716, "uuid": "7cdfd6d1-9ea6-43ae-9c73-4f31dbf1ed84", "value": "BANK DETAILS-METASURFACE.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a2aa45-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531756, "uuid": "fc615cad-b0f4-4d72-a29a-869b21b00f08", "comment": "Malware payload (Mirai)", "value": "6ccf17e4a362473596a9265a3f0090cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531756, "uuid": "30fec205-7282-4f41-a841-2cf4d43d80c8", "comment": "Malware payload (Mirai)", "value": "1d9ec5bea04c46918390b647305eb270c048ea09f90eb8d793b8260379adbb5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531756, "uuid": "f42a29aa-c7b7-467e-aa91-853aed40ec06", "comment": "Malware payload (Mirai)", "value": "d1b22be97226c17c534e83c45d5a504489af0b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531756, "uuid": "88d65b8c-e920-4694-a37c-fab9f3e59188", "comment": "Malware payload (Mirai)", "value": "788f05d572f746606e5b0dbaf47a77a89efad3c68f199edc4fade08bfd2484352b413d5271d92e685e6bf81335a0069d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531756, "uuid": "42680e52-3584-4453-a066-19d9823bfcb3", "value": "T1F433E8527DC26A2AC2E0137AF96E81CE332167E8D1DF7257CC211B0476DA55F0DA3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531756, "uuid": "1ba4403a-4815-4d45-bc4b-8eb0bc7eb1f4", "value": "1536:hCqZI1iDUguHppKKOxgPg6osAvH3Y0DWZoh+fgh8K:XZeAPDDWmhA3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531756, "uuid": "afb29167-b4cb-4d24-88ab-cf975cf58a62", "value": 52144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531756, "uuid": "821760d1-8e65-49f1-8676-d14e226b6a92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531756, "uuid": "608b102b-cfb0-417d-88ec-9d021d17b1cb", "value": "vcimanagement.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58df60c1-93e1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645535660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535660, "uuid": "096759cc-eb38-428e-a3e0-7c15bf20deab", "comment": "Malware payload", "value": "41994ded5b0fe13184ba5e8f5427714f", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535660, "uuid": "83df4c2c-034a-4904-8749-82cf4adf0094", "comment": "Malware payload", "value": "1dd9ab616a508a535e1da30c8bbed764ea2362bac39ef9bc4d953d790aa20b7d", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535660, "uuid": "59d28de2-5dd7-4af9-91eb-8b9e15fcbe2c", "comment": "Malware payload", "value": "dc86a0892d6807987345d617a4599c92dce1b0a1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535660, "uuid": "5f250f1c-2764-44b5-85b0-90072518ac1e", "comment": "Malware payload", "value": "8f8cd967389623313fbd87bb8bfd52d1a14ce70595843329c1c4ea0e080a058260429682ef1f70ae19970e698c9e09e6", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535660, "uuid": "cd26b9c1-dd08-4bea-a3e6-960e63215612", "value": "T1FF053398C92B362F9EF075A4EFD92B7A99E204804F30CE5ABA71DC18C01485DF5D1F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535660, "uuid": "7f564acf-4df9-4646-82d5-506eb3798902", "value": "24576:D47YqrK0p5SHyj2Gr70x2cvYiG1FElCWCuX/9HEr90l7N:DUK0pDqc0bYiS2s3upE50L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645535660, "uuid": "2cec6a30-75d7-4270-89c6-f8a6d5fc2a23", "value": 833121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645535660, "uuid": "d942fdae-267d-4129-a06f-7b8a88b77092", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535660, "uuid": "a90a8316-6ce1-4cd8-96f3-a8579cce7128", "value": "PaymentXAdvice-BG_EDG9502022020401200015_2725_950.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dab08b9-93ed-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645540688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540688, "uuid": "469874d8-13db-48f5-b24f-8c9124747e0c", "comment": "Malware payload", "value": "8bc56a1b1153b4cb3d926636e57c06c4", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540688, "uuid": "df2a72de-d75a-4d06-9fe4-1cb3a5abbdc5", "comment": "Malware payload", "value": "1df22bb56154d4c9d91bba66a290dfc5855b43e480437385fad95d1f6682173e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540688, "uuid": "7a024e16-521c-4ae2-88a9-1a6540ac10e8", "comment": "Malware payload", "value": "ea83fdf6c9a21a60736c949d5b4e9f0ba927293b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540688, "uuid": "8bf3b7ce-bc1c-47fe-a5db-63d20c803bdd", "comment": "Malware payload", "value": "65aac7a9b1405c34646c211f9f184c134978a8957c0976ea60ce6834f752830e9e5395d0e384d3e63abcb671f22f6939", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540688, "uuid": "8dc877e9-f5ad-4368-b90d-adfd2f18afd1", "value": "T18E9533568171C52CEC48E7F2CFC378B9064A9395420AA2DB5E3B23FD11627E5B3D9B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540688, "uuid": "fd6f15ae-6d25-4e1d-b4da-a6dcdaea52d4", "value": "49152:zZPMTpQHPCY9e5BhqiIbm72XIqH1Gf2zhQUvPg2C:FKuHPjSOxbkMDHe2zZvPg2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645540688, "uuid": "b79bc9d9-ac01-4f15-a5a6-09e8eebf65e0", "value": 1973573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645540688, "uuid": "cc51e149-bd90-4a46-b25f-225fd387278c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540688, "uuid": "a0e0520b-3f8b-4a2e-98d7-2c1c4ad584c3", "value": "n5mkkeis_Receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0efa835-940d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645554679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554679, "uuid": "47f8b803-d101-41c6-8629-959cea5f495a", "comment": "Malware payload (RedLineStealer)", "value": "3269ce00e22ec0a18d9db3d1e95dad21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554679, "uuid": "9a2e0554-3c96-449d-933d-c526856b58df", "comment": "Malware payload (RedLineStealer)", "value": "1ea0c67e4f186958b34ec572897b3ff5b4144dd5efb74523506e57d51ee33e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554679, "uuid": "f415411b-2683-4407-970c-b260313e004c", "comment": "Malware payload (RedLineStealer)", "value": "7311d464d54453a83f8116ef84195803ed57fb10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554679, "uuid": "4533c828-4303-4055-90ea-33434a4bd06d", "comment": "Malware payload (RedLineStealer)", "value": "1a40415b28a8a5d3cd95a1a8f5bb14b425e6abe0b6ae77b39f28c9dd7e3220b241faa1c49b1a49c8cae48a504d2611c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554679, "uuid": "a6d43d95-a21d-4659-bf13-1001fd917df7", "value": "T134F412417358DB16D5AC7FBC04D3902087B5B9AB44F1E21F9F8444EEA6B3B819C6136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554679, "uuid": "d99f91fb-6b70-4aa4-9792-7ca7cc39721c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554679, "uuid": "018a569d-c023-4c1f-a7ea-ce3751550813", "value": "12288:ccx3mcQTBCh/TTurTSiHBGrmWvtmiY6aK6xAccxKc+5la8217+j5d6ztgj9:vFmVT4TuuiHd4VHaKMcjsK1qFdStg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554679, "uuid": "f7ab6e12-1747-476c-bb16-3597175b3707", "value": 771984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554679, "uuid": "cfb4508d-fa4d-4d78-8fa0-79216c988ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554679, "uuid": "e5378e18-f86b-4568-aa6b-31e6a4ec0f5e", "value": "3269ce00e22ec0a18d9db3d1e95dad21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2ea16c-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645518464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518464, "uuid": "19fb7a65-feee-4924-887e-e2209dc4ec27", "comment": "Malware payload (AgentTesla)", "value": "4356e50b93ff6f71afaf72b9127682a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518464, "uuid": "28ceaf35-e50a-4d8d-a832-79cfb5c2cb5b", "comment": "Malware payload (AgentTesla)", "value": "1fbb3b3895edff859229314063dd09905b9babdcc766932d03aa5c25accafad5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518464, "uuid": "16e3ca02-96aa-45d0-8ccf-2eafe1e511a0", "comment": "Malware payload (AgentTesla)", "value": "1c7ec4c2c3ba412fc031fa0f6b752e7ed4a11385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518464, "uuid": "4a9d8b6b-ea10-431e-bc7d-69afc5c6244f", "comment": "Malware payload (AgentTesla)", "value": "de4e65bc95314f43de5f8b463c1cbea1123de91312b770a765d9eb3ddca316eeaf51527ab05ce00cb2851924ea5584a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518464, "uuid": "fa1add2a-eec8-431b-a9fa-f3cac004a2ec", "value": "T102356B04A7674F3DD0780AF114A0D912FAE4AFA71E04BFADBA4335EFC5716C1684D26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518464, "uuid": "688310a1-8afd-4122-8f18-495159892ca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518464, "uuid": "5374a8d5-64ec-4ce4-bd29-4a2d21b5298c", "value": "12288:CgB6vCnNlh7j88Chxptc2OEVJ0PKe3QQ856k38pL2Fj8bGQ0e1T0jlv2vMMFPK:OkNg8ChiEF8yV3Bjzmp4evz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518464, "uuid": "c31d9c99-9e83-4c5c-8c63-b4ab31c5efb4", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518464, "uuid": "275dd2d7-3ff7-4721-9d03-eef6f4bbeabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518464, "uuid": "42274497-6cdb-4556-aaef-b98abb78422c", "value": "cztMQMJReFG8gyR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b97ee2-93ad-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645513479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513479, "uuid": "7117051b-e542-487a-933d-bb1e47649b82", "comment": "Malware payload (AgentTesla)", "value": "18cf5ee0b3b1d67f615042974ac833a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513479, "uuid": "f0c988e8-7ce6-4021-8779-75c2d1f7e506", "comment": "Malware payload (AgentTesla)", "value": "20c5dd4d430b63488a68c1c2d46812680f7c6411a5fb11eef0463520fa601e4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513479, "uuid": "5a8c7967-5a10-4c9b-9ab4-0d53d248be00", "comment": "Malware payload (AgentTesla)", "value": "232732b6dcf880b66ebacb76a1d85bda32d4363b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513479, "uuid": "693e5cb1-dc44-4228-8b75-b5fca520fab3", "comment": "Malware payload (AgentTesla)", "value": "ff61bb9fbd99ac11b04d73329aca1d59460412ead8002fe1aa9ce61f2b61e175512163b1680980167871c92d27430088", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513479, "uuid": "883a84e0-9f48-4c76-9e81-3807d335daa1", "value": "T138B423E5EFDDB7BBBC5B36298441C4DCA89ECBC81802DD60942B601C3E1E541DB1999E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513479, "uuid": "39fad441-5ab2-4d83-a019-e71b98adccc7", "value": "12288:uH/vN1Gys0aqS/LjVXmUFsDbe/HGwZDQbEqUCc:uHHN4ys0aqSjZhFMAHHQIqrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513479, "uuid": "77249b85-f37d-4769-acd8-4ec89af2d8ef", "value": 511520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513479, "uuid": "7a2e66b3-2e81-43f4-9756-86c18b8cf3aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513479, "uuid": "b94e6e92-55a3-4150-9fd1-f632a4ecdc0e", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af3bd1b-93f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645542429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542429, "uuid": "ed5746f9-3445-4784-aa79-e3495c603636", "comment": "Malware payload (Formbook)", "value": "6409ef9fcc4b0059ae1634289f54bb61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542429, "uuid": "c4202476-2105-4a98-a95c-62129d70b77f", "comment": "Malware payload (Formbook)", "value": "2123970d5b86f40c0fd8b65203970bdafd7a8eae0af918e59959262e127dbea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542429, "uuid": "61ddae2c-f484-4d82-ab58-94055eb929ba", "comment": "Malware payload (Formbook)", "value": "cf5005502da66f6f949e484571ac98ee93787825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542429, "uuid": "5132c6f9-55fd-47c3-85ef-2683d5bc0b61", "comment": "Malware payload (Formbook)", "value": "a7ace8ab78651da9e10a41796e3ba940511b8f77bfb5ffe573af3ae5774d1cdd240e88403c1343b03722da8d267c6285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542429, "uuid": "230a4247-a0c6-41af-813e-d443a9adf6f0", "value": "T184354B9D365072EFC867C976CAA81C64EA60747B931FD203A06312EDD90DA9BCF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542429, "uuid": "1c949217-f804-48b1-a89f-d9d4e1aef863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542429, "uuid": "f6f16c8e-89a4-4d7d-ad62-875bd5936112", "value": "24576:M72Dz4nM3gl5bSj6UrzF9TISLgwRSYoVuV7hdtFd:M8zx3G5bSuUfF9TIIhRSYoEhDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645542429, "uuid": "0fc167bf-0ba9-450b-9be1-9df4181b187c", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645542429, "uuid": "cc10c41d-5daa-4b2a-a145-df6cc8463223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542429, "uuid": "067b5af3-dddf-4145-8837-db2e6676e922", "value": "PEDIDO DE COMPRA URGENTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2a7cb3-9427-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565789, "uuid": "969aa18f-6118-4c01-87b7-0dacc0a59985", "comment": "Malware payload (Heodo)", "value": "9582d8d7554795755aae71e5daa987fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565789, "uuid": "8f74e17f-12f6-40ba-88a5-d04550e84a8d", "comment": "Malware payload (Heodo)", "value": "22cb31eb1097ac474221c421ae5945871bbf8adccbd5b3c514b4770215b84bfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565789, "uuid": "ed845bee-015c-4863-910f-5ce21b0a17a1", "comment": "Malware payload (Heodo)", "value": "5ea1e91944c5e94bf6ced40631792245915c8514", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565789, "uuid": "76779a4c-ad16-48f6-801a-31c2e028d43b", "comment": "Malware payload (Heodo)", "value": "cc30175dc3a9d7ee105c4c0592fa05ac3cc56eb8b8b114ff5bb2f87f24dc54872a46109a3becd2c341a2afa538fb69ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565789, "uuid": "b2617db1-0b24-4b6b-8b51-e1552ee68522", "value": "T150B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565789, "uuid": "21a4026b-fc10-4577-89a8-12aef31ab076", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565789, "uuid": "0fecbceb-ec01-4d23-9ebd-7ed91f2e89ee", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wKIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWVzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565789, "uuid": "4fb9ebd0-68a8-4e10-a9a7-d9f6bbbdf4bd", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565789, "uuid": "ff36349b-59e2-447c-9e44-34b4af06773f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565789, "uuid": "97e42ed1-d304-4d48-b97a-d0e677361ea2", "value": "9582d8d7554795755aae71e5daa987fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2149571e-9374-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488752, "uuid": "9aa3705e-0ca8-41c5-b69a-fd66e3b59000", "comment": "Malware payload (Mirai)", "value": "e8291a5103acd593bc5a2e151008ebb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488752, "uuid": "612e0e76-7558-4288-ac2f-3cfa191d10c4", "comment": "Malware payload (Mirai)", "value": "22d4eaa2b8aa1b022ae796b8bc3d427c3fb5c134a428f4f6fa3fdd49c481cccc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488752, "uuid": "d3422240-ff2d-4917-adf6-525136219170", "comment": "Malware payload (Mirai)", "value": "4040bb7fb8fce5c09a3546065ab5fbbb21f4b5e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488752, "uuid": "dc7894f4-f989-4c2a-afe3-5b895e2b4a87", "comment": "Malware payload (Mirai)", "value": "19d89ee4e3b584ea0197dc8d22247284ab1ab866859bdc37ece5d26db32e9acc03da9dda2816c33138c2b8cd6a2d1487", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488752, "uuid": "2d019d54-6fff-474f-8868-cb859113fed5", "value": "T1D1E2E0B64068DB81D5F8C73B409D0CAAF321DD3877AD4694638F94E2B902F7B43A4758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488752, "uuid": "295d1b69-463d-4289-a656-f93080014243", "value": "768:Q9GnW/JHw3ala5oUa2eed68b27Z2vykTihkTQyKx:m/JQKUmek8KLkyya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488752, "uuid": "a812a454-4299-40aa-a88c-ca2803b34464", "value": 32380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488752, "uuid": "06875be3-27fd-4235-8bd5-044fe9840040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488752, "uuid": "872b4fad-5709-46c3-bf1c-35b7864faf74", "value": "e8291a5103acd593bc5a2e151008ebb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7e9408-9395-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503082, "uuid": "6973b157-073b-4780-a6e5-d512498bc37a", "comment": "Malware payload (Mirai)", "value": "fd294416d2a592f690a0f9a0e5f4563f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503082, "uuid": "66220ffa-ecf6-42e3-8bcc-03082ef48d50", "comment": "Malware payload (Mirai)", "value": "2310e36e79d2ebd1a977022aa63b055093ba8349dfb5f13d33f3d2aa40bb68b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503082, "uuid": "44b34fb7-fcc8-4f2a-bd52-f068ecfeff52", "comment": "Malware payload (Mirai)", "value": "af6f7f1f2d9a10f7cf8d4ff9c4e8775d27537b57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503082, "uuid": "bcb3a42b-9fcf-4af2-bcc6-cf6ee006466d", "comment": "Malware payload (Mirai)", "value": "fff19c1d1e11b459a9b414c7b647cddbbdbaffa8ccf60a0426c9be894909b0bec9f67f311c49a14b916701d5e456dc11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503082, "uuid": "ffabba9e-c9e0-4539-9d33-bd4eac97650e", "value": "T1D0833A87B5F3D1F2F95A10F4B06E6B319E37E4B6207DD983DB985872B814902B60678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503082, "uuid": "74ef671c-1e17-45d8-837a-4ec3f3678577", "value": "1536:JO2HhifTRcJ/tTHe9nyaqDnzcyQIkxAqaJLIbhg:JONk/90Azbv6ADSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503082, "uuid": "e273bc13-1254-49f9-9ca5-237eb659e26c", "value": 84196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503082, "uuid": "64677a70-88d1-4536-9cba-a6bf10753319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503082, "uuid": "cbc26f4b-e01a-4d62-83bb-705e18f448e1", "value": "fd294416d2a592f690a0f9a0e5f4563f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ed45b7-940c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554256, "uuid": "1df034ea-ca68-4df7-bf85-d3f9e6a43810", "comment": "Malware payload (Heodo)", "value": "e8c2683816fef2a9006c52fba2549fd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554256, "uuid": "49eb387e-a324-4d60-b2f9-493b060c31e6", "comment": "Malware payload (Heodo)", "value": "232590a675ca44402c5a05cf98728857a88984144fc4e187e38da8fc59568c8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554256, "uuid": "aa1ca67e-b8aa-4629-8011-bd173f535d9e", "comment": "Malware payload (Heodo)", "value": "967b3c17ea21ef99ab1e6d196394430ec5e3b699", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554256, "uuid": "d3e364cb-c837-414f-84f1-282bc4a3c2d7", "comment": "Malware payload (Heodo)", "value": "448c1bc7ccb28bf543e9f4f935d573c7762ea86c73b996af1cdb114865c4520138ebccdfe334c2302df47819b23fbbfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554256, "uuid": "ed66bd2d-b179-46c5-8773-9ac8d29f6403", "value": "T195A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554256, "uuid": "6819d259-a3e7-4662-a113-fdfa065d6a3f", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554256, "uuid": "7e0e8d6b-ee5d-4404-ab8d-ee201ed27c23", "value": "12288:vicw4w2Vb0zq6k5Z2mTDjqkGXNrGHORQuBT:viSwub0W6LmTFwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554256, "uuid": "22bb7310-2f68-4713-b7ab-cdad57cff6f0", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554256, "uuid": "194cbb49-8f9c-48bb-91b2-15ada9baa326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554256, "uuid": "536dea80-bc0b-4165-9a03-e70127fa0d12", "value": "e8c2683816fef2a9006c52fba2549fd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd8b358-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645513929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513929, "uuid": "e7ce33fb-17eb-42cf-8068-f03e313cda6d", "comment": "Malware payload (SnakeKeylogger)", "value": "909215e442aea9a456652c56f697a54e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513929, "uuid": "072e87e4-b3eb-4045-b3f6-c53d1a29d3b2", "comment": "Malware payload (SnakeKeylogger)", "value": "23fe89ed670c75953f8570688720db99415a6115b6e27f9dd5299e14ee22ca16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513929, "uuid": "2defe2d0-4717-45ee-802d-130937293d13", "comment": "Malware payload (SnakeKeylogger)", "value": "e6da1b7c36df3354e7d47bd05288374a54f9c362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513929, "uuid": "d3a2ad9b-cc4a-42f2-a80e-95aca39b4584", "comment": "Malware payload (SnakeKeylogger)", "value": "02e39b803403913696c6ed35d49633d1646d16ee8b9d91430ce6c9522d9187ff2ff99500a1c69766f350c3dd9d9f21e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513929, "uuid": "0ea14ff4-f920-4066-9deb-e65d5fa7391e", "value": "T113D3184C3BF88804EAFF8A7311B16121C7B5F951095ACD1C6AD1F9692E7DA408D2AFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513929, "uuid": "71320843-24e8-49b7-ad31-8b5bc735449b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513929, "uuid": "03fb2000-65ce-4b8a-9962-6bf4035e5ebc", "value": "3072:Ta4ZxoFgR8/2q2/NZmsA0zbCEKwB2PnbY:P6jv+ZBVbPkvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513929, "uuid": "4117e330-2ece-4c61-8450-a553d6668937", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513929, "uuid": "3d61a14a-30b1-4892-bf09-a64a87874ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513929, "uuid": "01d529f2-bd2f-47b3-b470-367d826dc7c0", "value": "909215e442aea9a456652c56f697a54e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df119c7-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518060, "uuid": "ef2e905f-edc9-4bcd-9feb-2fa873cb3ef3", "comment": "Malware payload", "value": "04db1d0e8c94810a4ca45663276e5a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518060, "uuid": "e3f7dedc-8a3b-480c-9727-dfd57164f724", "comment": "Malware payload", "value": "242b9cf7cbd9fc178becc96ff435a0c36eed8b9d3cf929a00898953de193b1f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518060, "uuid": "51dbe18f-789c-4889-aac0-55bbf0ad2442", "comment": "Malware payload", "value": "b29bd173c745df6ce1e75a7a6d91c03ad3182147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518060, "uuid": "d19195bb-3e45-462b-9245-6af626ca5572", "comment": "Malware payload", "value": "32b648287ce297bd0321ccec9cce6badcfdd62811b5573a1aa75ccb2d8c39ec6ddfc4a9b484a702e43b48a9d24a164c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518060, "uuid": "ae9ec563-a7e5-47fc-9e82-4c2370543ed5", "value": "T18DD5336B1447B279A9807C28A73CFEC425887473862139211E17D2F861B6DF2EFD6B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518060, "uuid": "ab5f60c1-696b-473d-ac60-7349cbd12b8b", "value": "49152:ewE8J99lxhYV7npeOSaQ++9VHvggT4RSMSLicvE/rn1ucMSsIqkG1zHzPbabB5GI:eH8J9bw7npeOTQLjHYkANSBYnUSsIqkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518060, "uuid": "307a53cd-cd0a-42ce-99d0-7171b2de8e65", "value": 2848339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518060, "uuid": "66ff4114-6acb-42c1-82a8-270fd5c9c64c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518060, "uuid": "b9685339-57cb-40be-b9a2-f6a8282d9193", "value": "04db1d0e8c94810a4ca45663276e5a2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6632948d-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554151, "uuid": "2a9334db-d290-4dcd-ae6a-a20604c16198", "comment": "Malware payload", "value": "10b18265c3507b0c5df624d378030e6b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554151, "uuid": "8e487d40-33e2-4cd7-ac05-68c8cc89785f", "comment": "Malware payload", "value": "255b0a5311ebd45837f2be127bd29f7b9e3ad7c99a0750c251f9131ec449d947", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554151, "uuid": "d4fe1cac-b379-474b-a33d-f698db1b0b11", "comment": "Malware payload", "value": "6138b2e1483bdfad18d029f0ea0116a3f6b38ed2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554151, "uuid": "f301d275-330a-407a-8704-dfb44745a065", "comment": "Malware payload", "value": "561f197626d0874d729bdd123e71928d9a4fd9869d3eef5c472010580fe30f1215119835823ff0eadd53a5d82c9f34eb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554151, "uuid": "00e13506-f7f0-4f14-8fe9-f05e7faaccfb", "value": "T110930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554151, "uuid": "57e00361-0d5c-444e-b769-28c7593cba07", "value": "1536:Jyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQsykWvgrPE4nWHPNc2Ap:Jyehv7q2Pjx45uoDGTj+5xtekEvi8/dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554151, "uuid": "5e29213b-f972-426a-a8fa-926a81d32c91", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554151, "uuid": "e645641f-3623-4a59-a573-40783c7e9e7b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554151, "uuid": "4edbf05f-daa7-4bdb-b52f-71515c96aca3", "value": "tmpmv2urxhi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6427f0c-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492089, "uuid": "57f84597-beb0-47d5-ab0d-77b496f2f5d7", "comment": "Malware payload (Mirai)", "value": "c69322361d39031103605472425246f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492089, "uuid": "1fd9dd51-d6cc-4586-a329-1825d05a3dc7", "comment": "Malware payload (Mirai)", "value": "258ba0aa952110a9e061c217ef276190a4c02957bc20dabee1dc4eaeefb72814", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492089, "uuid": "9b02f061-6ba0-4ea2-8684-14fb99af2e2e", "comment": "Malware payload (Mirai)", "value": "b68e55f5df2a0b0b38714218c1361e40ddf7bfa9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492089, "uuid": "aca2edd9-ff7b-4f7f-b0c7-0a08a4ff47b4", "comment": "Malware payload (Mirai)", "value": "40f0ef7a6115e348d0c2fb4180dce76bfb089860164523561b8a87151a72d6533e15954aa93223150a2303f30f853451", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492089, "uuid": "25448d55-a46f-4522-baa9-fdd718542240", "value": "T18D4302B08D4B2B2EAED48F78D2BF40C6A38853BDF5E6386576802D197CC630974E9053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492089, "uuid": "5ed23876-b084-480d-bd15-cc9ff8922e48", "value": "1536:CIIVzmipQzXyZ4UcnOuNneDLeQ1Svqw9sxt9HuA:CIyzhpQzXyZAnOXDy0SvmTHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492089, "uuid": "5a86d09e-e90b-418b-93d6-a3813c1e4455", "value": 59628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492089, "uuid": "7c58ab0b-27d0-4632-9a03-62a411e7e293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492089, "uuid": "5db3536f-4c24-4083-98b3-3fab98a1c3d8", "value": "c69322361d39031103605472425246f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1af0799-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518307, "uuid": "f42000e3-8ce0-49a0-aa41-aa67e8a0026b", "comment": "Malware payload (njrat)", "value": "9fe0ff6ff4ef346caefbd7495fd6a172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518307, "uuid": "ea25a32b-57db-4eba-ada9-7e5d2e1c222c", "comment": "Malware payload (njrat)", "value": "25979f257bfd7f74e54f7ac7eedb648ae7a6b3b6e209db7a7e923653ffb4d4be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518307, "uuid": "0d1366cf-d9fc-4b2d-83e0-75110ec3d191", "comment": "Malware payload (njrat)", "value": "d0894463595865ee2e8ba2ea2be160b746972f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518307, "uuid": "9302d7d5-61be-4c40-b72e-1e623ed9ed0c", "comment": "Malware payload (njrat)", "value": "f6511a07ddfc061aa3cf2e40adfe84dfe54868b342cfdcb72dd94470753fb58483cf6f5c728a2f7693194004ccee5c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518307, "uuid": "be1a4b39-1656-4f26-8b6c-a98fa3f93d2c", "value": "T124032B4D7FE18168C5FD067B05B2D412077AE04B6E23DD0E8EE564EA37636C58B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518307, "uuid": "67dc9f83-8aac-452f-8a9b-1a1e974e2e18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518307, "uuid": "8dedcc6c-0d45-4924-82ea-b6656aaef004", "value": "384:c8+s0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3b:sFdGdkrgYRwWS9rM+rMRa8NuWnNFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518307, "uuid": "ea815d10-8e30-4204-a7fd-b53ba7872939", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518307, "uuid": "a566cecd-dfa3-4bf8-bb59-654d85b8d3fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518307, "uuid": "4f1fd59e-f2eb-4d51-83e3-5f977432c5ac", "value": "9fe0ff6ff4ef346caefbd7495fd6a172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170b5fe4-93dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645533403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645533403, "uuid": "0489cdbb-930d-4e4f-9819-64bfc1090cac", "comment": "Malware payload (Formbook)", "value": "150a030ea3c7aea4ed913675ece8c216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645533403, "uuid": "fdf4e263-9125-447c-a0c9-b5cff9e0aa24", "comment": "Malware payload (Formbook)", "value": "26798b4b47723f6da536dd8db538b00b38cbe4b00b73047cdd9b6333defccb10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645533403, "uuid": "f3668d5f-9c58-4df2-9368-ddda0beddbe6", "comment": "Malware payload (Formbook)", "value": "83e96c23b56bb7c8ec212f80262b76635ce15a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645533403, "uuid": "e89af987-97fe-4860-8596-b36f46601a5d", "comment": "Malware payload (Formbook)", "value": "d9b6b7fc57b9b9c1c8def4e429fec46bd2e0ce98c5ba05d8d3612c6d56da90a9e6c3fd4ec6c535bc764fd6ef31206369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645533403, "uuid": "142c6cca-4ba2-497c-9bb3-c8b3556339a3", "value": "T1BE354A9C365072EFC857C976CAA81C64EA6074BB930FD203A05712ED9E0DA9BCF155F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645533403, "uuid": "6e7ff1bc-de4a-434b-9b7c-ddcbc8c132ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645533403, "uuid": "1eef284d-37f8-4c34-8a3d-57b2660c62b6", "value": "24576:5OW8ethTJrgypUHIevCU6JDAVrzNxVUJ+6hjybY0pB:c41gypUHI8IAp1SHjybtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645533403, "uuid": "53996601-8514-4271-91c5-13033065394f", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645533403, "uuid": "426ef568-db10-4e7b-b980-0e00d9be354a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645533403, "uuid": "580f0262-a467-40f8-b584-04c9f73bb0f3", "value": "REQUEST FOR QUOTE - 86383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5600fe-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492046, "uuid": "09b16479-4260-454f-87c6-c4292d2950c2", "comment": "Malware payload (Mirai)", "value": "cbe10df58e27f9e7c898e0bce698bcc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492046, "uuid": "8799b0c5-826a-4ce4-b595-55a5d3823bda", "comment": "Malware payload (Mirai)", "value": "2760e7dcdb9d4f90b73389ef380040cd2daf76be95661c0bafea0538fd1efafc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492046, "uuid": "c4303e97-78ba-4b2a-ab4b-cd50824777f4", "comment": "Malware payload (Mirai)", "value": "fb51adcd337f86d592e54bd468a9bccbacb155e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492046, "uuid": "224aaaf5-facd-4b59-b37e-d26bac8cf298", "comment": "Malware payload (Mirai)", "value": "5c9b0fb3cce5802407e0cd49bbab3de68621f521c09d7b61da37d585a1e052d1ca0ccfe9ffed42f24e97f411ebfa44f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492046, "uuid": "ee2c6b88-5f76-48b1-b3ad-e995421796b1", "value": "T1A2F2E14D49461D4EC8ED4D39258A07368BA1DCE133289BDE930CCD94521BA8BBF4F9DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492046, "uuid": "e50bc90d-a735-482d-9942-bb448f413838", "value": "768:7YiSIIZXuGl+Z0UNy0h/5tW5H6jUBj+ll8Jj0FOIWMC:+NluG05h/5Y8UBSlSJw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492046, "uuid": "3e8ead4f-29d2-4fbd-ae72-14d1a4e95c69", "value": 36000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492046, "uuid": "dc142936-d2a0-482e-9725-67ce03287234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492046, "uuid": "bc3c2a70-4c24-4dd3-bba9-5346c3ac1d17", "value": "cbe10df58e27f9e7c898e0bce698bcc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2759e5b-942d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645568533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568533, "uuid": "8bf830e0-d2e8-478d-bc3a-79c5d8f4642e", "comment": "Malware payload (Heodo)", "value": "eb9758b52bacce6ea95632a827231a81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568533, "uuid": "a1e22a12-bfe5-431f-8ce9-90619c893d9e", "comment": "Malware payload (Heodo)", "value": "27668c6c4d2f59a38c9e444b1edab920292ef30ca15094a110771b3210effc56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568533, "uuid": "7a9a94c3-683c-42f0-b80c-682f78bb936d", "comment": "Malware payload (Heodo)", "value": "8ff9964c5c6f9c5e3bcab8569910d55475f8142b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568533, "uuid": "09bfb904-4f4b-41d6-957c-779b55fe350c", "comment": "Malware payload (Heodo)", "value": "5220732e462a28b73caf2c2ca629f3f28fe80909b9cc8abc7b329e789cbff172012f2a0882b88a872a0d746c9ac8e02d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568533, "uuid": "f7817da1-4c8a-4b84-aca1-16551218d75a", "value": "T1DDB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568533, "uuid": "d3300e12-24c9-44bf-9656-8c44f5c8b10d", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568533, "uuid": "f837a652-50f0-4ed3-8975-f816efcc9686", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wLIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWMzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645568533, "uuid": "80176a23-9059-45db-a9ad-0978f284be2b", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645568533, "uuid": "8d63dc67-5ec8-4c27-871b-f62fb84b8948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568533, "uuid": "81b2ea21-0588-4f95-9488-f8ccc9ba0db1", "value": "eb9758b52bacce6ea95632a827231a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4e45ef-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490091, "uuid": "c02a4b14-5e8b-4569-bf9e-eca1f9749929", "comment": "Malware payload (Mirai)", "value": "20c9705ba3250fba34149f4c46b8aeef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490091, "uuid": "19573cc6-ac30-4cef-ac1c-5e935a9e4a72", "comment": "Malware payload (Mirai)", "value": "27757ddccd9d1d7251c6cc64430ba6b073525ce950e17e60f4993cda3c695fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490091, "uuid": "8175dc77-c0eb-4413-8579-e0879819a1e4", "comment": "Malware payload (Mirai)", "value": "bc410842ded01318dcf9eb71105f9ecccd18112b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490091, "uuid": "d7e2973c-b0dd-45ee-b424-1de5c4f17e06", "comment": "Malware payload (Mirai)", "value": "864ac99712436b3cbd36d662e37c907714261d86940fb4acb67c9e41e67abb0bf1bfd22de4e6affdf20697e4e032b676", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490091, "uuid": "30d99a74-a24a-4a9f-b51a-83a8ff0047bf", "value": "T1AD33F143E16B8F64DF79627FBDE5085A67322BE7E4D910CAA7095B2480200F713F9E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490091, "uuid": "b31bbe05-a14f-4b86-b298-0c7b98b66445", "value": "768:CJomkQ+czIzxKVS5qYVnbHNWtQqrG/HacJ6QNUVh9q3UELgCV7tn1BdSFzty1jN:nmpgCoHNW7GHvJ6QVLgChajyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490091, "uuid": "3f0904a2-49e7-406d-99af-80ef8519d8fd", "value": 53288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490091, "uuid": "e1f26026-b984-47ad-ba84-6c2e869e7db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490091, "uuid": "0eb1dd1a-2cd5-46b3-a3f6-a06f0c15c210", "value": "20c9705ba3250fba34149f4c46b8aeef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c6a743-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531770, "uuid": "6bee64ee-00cd-41f2-be32-53ab49b18743", "comment": "Malware payload (Mirai)", "value": "a415c1c3233ad9820fe25e5ffc865416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531770, "uuid": "f3fb48c1-ca7c-4da6-95a0-ffb27e1b0076", "comment": "Malware payload (Mirai)", "value": "286287c47bdb7fe2dc92ce362dca5a704cc4f64d39e76b0271dae50e2f83c2ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531770, "uuid": "2e0f4487-3833-49c9-b30e-61655462f272", "comment": "Malware payload (Mirai)", "value": "5cef33f109fbb54b37e81f5307aaa8ae9e2a9b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531770, "uuid": "fe22fd0c-241b-43a8-9d8e-4e9d3b4c69fd", "comment": "Malware payload (Mirai)", "value": "6e2e0446fab6ec2a8017e0598060f6f4aa69ed477efbf3937ae621c1d9bebd143c86aa6a1dbf59bfcc08f95fb4d7f0fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531770, "uuid": "a265e1b1-144e-43d4-8dab-efc8448c8b8c", "value": "T1E893B61E3E258FBCF79D823547B78E229658338A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531770, "uuid": "7750a58b-f5e4-4970-bb89-39645de04857", "value": "1536:bK/QR35eT0Ata648QFdyAOVDZZYHWmdXSWYkhoh9q:ke3sTPiBwAOVNZrmdXSWXhag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531770, "uuid": "3cbd7c8e-4b4c-47d4-b0d7-e5500c668182", "value": 89628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531770, "uuid": "aae1bfe0-1aef-4108-a749-179bd82498c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531770, "uuid": "10331589-5212-4487-a41f-f965235641bd", "value": "vcimanagement.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b6ead0-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645517261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517261, "uuid": "1bcf151e-83fa-4e92-b0fc-22bce385235b", "comment": "Malware payload (AgentTesla)", "value": "d959687d78102ec87a11da1ec03a78b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517261, "uuid": "cbd168ca-5262-44d7-9088-ee69ce886278", "comment": "Malware payload (AgentTesla)", "value": "28f8639327d0298b913f95a51b29093f2bd9f4efb3442ea20ae202ec998b1bd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517261, "uuid": "584b3ddc-3dc8-4340-a9c3-55cddd353787", "comment": "Malware payload (AgentTesla)", "value": "f20fe6780e099d5f41efb950e2c9df8afacbbccb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517261, "uuid": "03606ce4-3c54-4822-ae19-3393cecdf68d", "comment": "Malware payload (AgentTesla)", "value": "55c984dc3a5bf783e00c2b7e069caf5bbc12a20fa2e953da054b0e087dd48070215c71e98c4d1fd924651a9152f11b4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517261, "uuid": "d61194f5-3f5e-445c-85ae-46759825bf84", "value": "T142910AA1EA9448F6ED3C22FA7F47452AD52AF13C17AB03E71D80243E96594C01EE5882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517261, "uuid": "edd656f3-1b0b-40f5-a5d0-646ca0eb486f", "value": "48:Zvt1Fpj7ZXpJ0u+5fbSzp3uOhqHMdsGxi78gZ+/SZ53NjZkFDXg749buJT:Z1jp59t13wMddxi66ZXjZYDA4puJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517261, "uuid": "fb257c2e-dee7-46bb-bcb5-ad47a3c98994", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517261, "uuid": "b8332339-f72b-465c-84ec-41a20891e325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517261, "uuid": "cb9e10d4-285c-4da0-b617-f99978f79bf6", "value": "Arco RFQ21.02.2022.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13efc5c-9398-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645504509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504509, "uuid": "03281e4b-1731-4347-a1c9-99456035f85e", "comment": "Malware payload", "value": "72faab43e00ec39163a9faede9cc9229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504509, "uuid": "a4f8a80d-af9d-4a79-9360-6d84a93c944c", "comment": "Malware payload", "value": "290e2544392512304425f90471e4aad74a76e4e3d29e16109bc798e05b12c3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504509, "uuid": "f2b2916b-39aa-4425-9a21-89da718e3d20", "comment": "Malware payload", "value": "b4621303609ce55c5212d07980251bc8b65e12f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504509, "uuid": "79160baf-3d92-4941-a00b-967564174de1", "comment": "Malware payload", "value": "1e73bea96e8981cba5e5829d155bfedec1e608e6fea5533c599257883c07c66d6de3d4e2f65e53bbb5fd351962195d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504509, "uuid": "aa804f18-5631-43f5-a7d6-3e723b30596b", "value": "T1FD7412E6A18081E6E8620B75C0769F1E6AB37C197DB1B34E2B5979BD03331C3A4365C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504509, "uuid": "05d50e35-f7bc-4f16-b43d-29e52f7deae6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504509, "uuid": "c03dd8c7-601c-4e99-8770-5cea878a19bc", "value": "6144:/wBufKcizW59u+bCcPRp/FUBw40Ki2fFjitdbJDRaUdZsywOThL42AKTACiRrhs:8u9izW59uwvqBw40jCpODRaUdZdTMKMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645504509, "uuid": "7a95a8fb-358c-46c5-8540-9cf7d14b5613", "value": 337822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645504509, "uuid": "68a249d2-a900-4ba4-ba7a-8ed46c72a020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504509, "uuid": "d44f0a08-493d-402b-a641-d6800c09eb1a", "value": "JP181213001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae55575-9419-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645559662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559662, "uuid": "df352a0a-20de-4b0a-9df5-b638a888f771", "comment": "Malware payload", "value": "b54fe0dba10d51bdc891e4c89f723386", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559662, "uuid": "1244218a-e95f-4698-af94-675dee1531e1", "comment": "Malware payload", "value": "29f90db1c463146793c85d852e4d50f65bb6bce7f14f6ca8ae2cfcf15c8ea4c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559662, "uuid": "a3dead97-731c-49f0-8207-d701e7370466", "comment": "Malware payload", "value": "ab46b027d3c8a883958db5f049043fd45cfcb362", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559662, "uuid": "a5d4c0bd-7121-4ddb-b617-5b71d365322a", "comment": "Malware payload", "value": "d2ce2dcf800f6c56b466e32f1ae0740b925d37c907ba0a36a3d9b10a7335bb1fb28b909217482379cda95a0e97f3860d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559662, "uuid": "334f3c58-aeac-48f7-86a1-4906bb8dc3c2", "value": "T14643E0251BC59674CBE50B7B30B296120735FA5E5E23FB0F28AD92201F933D8CE52765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559662, "uuid": "95315190-e506-43b9-a26e-b53d363e3317", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559662, "uuid": "f43ec3c7-b6ae-4b31-8f11-946770d8935f", "value": "1536:8z0hkgCFA1pgZRefHx7W7z5NDlxBTw7C:yekgx1oRefRCLhbQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559662, "uuid": "fec2af20-1735-4f04-9eaf-a7e44dd8b782", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559662, "uuid": "737fca42-4dae-4fb5-a451-fa38797bed3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559662, "uuid": "0cc60b50-d10a-45e1-8ff7-5d25ec8bebf9", "value": "System32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8715bd-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490056, "uuid": "5e2228e1-a8a0-4639-bd5c-43f7c28654ee", "comment": "Malware payload (Mirai)", "value": "481758f46a327cc141c4d8ddb793186f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490056, "uuid": "9b73f912-1667-4b90-98cc-496e9dd66413", "comment": "Malware payload (Mirai)", "value": "2a414c026959adafe4929b5bad9f794bc9322337f31bd85c46bd1518a5537fea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490056, "uuid": "5c222762-5a22-4111-b07a-146e9b2947a7", "comment": "Malware payload (Mirai)", "value": "3a630c27672eb5187f71f077503ed2e80f0cb589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490056, "uuid": "1a5216e5-7af3-4ef4-84d3-5660b2c806d5", "comment": "Malware payload (Mirai)", "value": "b5b8169beb4ea36939d3a20b7e4636adec2e26eee3d260c768f8d9df484615fbfd2d9e83260f357373e103d7dacebcaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490056, "uuid": "7b434bcf-864a-4f35-921d-503a142c4090", "value": "T17DC2E135E0940CC4E54A8FF0C8A6D3CA77608EEC2A75DCD22D42EBF212298366305FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490056, "uuid": "26d31194-c5d7-4cc9-88ae-c7105190968f", "value": "768:x9oxqHuU2x0PhCkJb+UC+BFuBFfKp4uVcqgw09Z:x9o+64J6BQp4u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490056, "uuid": "b4763da2-555b-4619-89e9-2d64bc6158b8", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490056, "uuid": "e0b873e9-8b02-43ee-a73e-b29996814b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490056, "uuid": "bf943591-19d2-4d2b-bef9-c4711eb5e68a", "value": "481758f46a327cc141c4d8ddb793186f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba688abf-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645504041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504041, "uuid": "1b209012-31e9-4168-971a-c024538b7e69", "comment": "Malware payload (AgentTesla)", "value": "8b1a868d8143bf3c3436602e66a9d8ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504041, "uuid": "66ba77d7-e88a-40c8-ab76-6d89d8e900f3", "comment": "Malware payload (AgentTesla)", "value": "2a549e4519643560331098e762654f4c7098dded8a7edfb3c18d884fae52c146", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504041, "uuid": "eb7dc879-540e-454f-8308-5c330f117248", "comment": "Malware payload (AgentTesla)", "value": "ec4859ce6f482c2484e2b5787a98cbd46bdde087", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504041, "uuid": "47ff12fa-d3dd-4afc-afd0-111bb786036f", "comment": "Malware payload (AgentTesla)", "value": "299f4736d24e92357cc2668b18ff731392f3f90cceb2ce993cb258382a5c7165f129046931a98aee2535c8b1bac6f9d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504041, "uuid": "be742f82-7f3b-4489-9847-056c7ca60616", "value": "T1B815CF542AA70F3DF1BA4BB269D0EC64F7B8F2236C15F37D7841158ACA52B408D522B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504041, "uuid": "2e97b66d-c9e9-4aaf-858c-0f09a49cc01f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504041, "uuid": "2c43f301-3ab4-4ae6-ab23-ee1860e84671", "value": "12288:DgB6AivNKh7jBU3/P/keTV4fgz/bxiHUCWt+xMP9EsA47ckkSWs7KhlPh:4ivNSU3XMeAHHOxP9Xc5S97+Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645504041, "uuid": "4c0d859e-608c-4756-aeac-c98e0788e6fe", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645504041, "uuid": "3d283fe5-b3cf-4b06-9624-527db26ccb2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504041, "uuid": "e6d598b2-24f2-4d51-8566-dca2fc43e8ee", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0d350f-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645513924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513924, "uuid": "a3ad4f60-3808-4a82-bf17-335b24aa3652", "comment": "Malware payload (SnakeKeylogger)", "value": "8ebf2413f0be088907d4817f36fc4662", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513924, "uuid": "93fe12eb-50eb-4d5a-97b6-9a45f2e0cbfe", "comment": "Malware payload (SnakeKeylogger)", "value": "2a7d77404a47a368e29147ecd69687338c3e0ebefb137d459b28ed0305420620", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513924, "uuid": "81f546d3-6b3c-4131-af26-347e68bd93f0", "comment": "Malware payload (SnakeKeylogger)", "value": "5e895a973e7cf26ec2299663ab6bed3d84068189", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513924, "uuid": "1b9af112-8f12-46d9-b961-45e8f7529d30", "comment": "Malware payload (SnakeKeylogger)", "value": "978d3003302dc3f0af776b2ee44a91f8537879003041a17feff1d788d22fd1f51906071a9f72069c2f8cf87000f434c5", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513924, "uuid": "5cbc6199-b1e2-4cf7-b064-b46e049d7db6", "value": "T1E905BF042AA70F3DF0BA4BB689D4EC64FB69F7235C09F37D78406596CA52B408D82677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513924, "uuid": "0c0ece68-384e-4c8f-b746-987dff23985f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513924, "uuid": "fbaf5990-090c-4dcb-a39e-b61c611abf74", "value": "12288:6gB6gtTNqh7jiA/Lj1IhLo36j2J0c5QSH4GJ991OtyxKmGYy:ZtTNWLZILoYM7910t8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513924, "uuid": "115cbe66-3d38-4334-a062-69d5a679a883", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513924, "uuid": "c4c0cc60-c1c2-4fc3-88a8-27e14ab7ebb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513924, "uuid": "25db1344-a80d-4b15-b315-e06b1c98e0f8", "value": "Order160222AX1.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f1cdd3-942a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645567004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "7a4e991b-5b7b-4bcb-bde0-e6b9056edfc0", "comment": "Malware payload (Heodo)", "value": "7aa34606c04ca4518b7e267e3a31e101", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "33b77dd2-d008-428f-8f45-0487587168a1", "comment": "Malware payload (Heodo)", "value": "2b6991b2a9e7cb496b7569860fc4fb3cd3e244885a6664b9a84e4e3a44fc70d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "66e61681-442f-47f1-a606-95a8e2ed9ea7", "comment": "Malware payload (Heodo)", "value": "5c7c2b5cad535c2b78066ff79608f8a99ae62518", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "9ef6c7c6-9699-49fa-8e82-8244e246d509", "comment": "Malware payload (Heodo)", "value": "acafefcaed96dc11c5b552eed3eab84741a2e9f4129ea3916b6027bf26d21350937273564c68b043fa09e6a963f0826b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "8c6b4df4-a066-4c96-a606-7779b580b098", "value": "T1B0B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "47a01ce0-d2ec-4b98-8db1-9add6885a00e", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "3984e8d2-4fc8-4083-a317-7001295f9fbb", "value": "12288:IOzyEtBX2ZHq79+I6/G5YgvmgZDa6A9TU:lnmZKR+YYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645567004, "uuid": "7c54bbe5-abe4-493a-93f2-d3600b65917d", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645567004, "uuid": "3380a998-fab3-4c3b-b880-e26829de4e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "63c7f36c-6fe5-46ed-a398-61b614bd590f", "value": "emotet_exe_e4_2b6991b2a9e7cb496b7569860fc4fb3cd3e244885a6664b9a84e4e3a44fc70d9_2022-02-22__215639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800c8c1a-93bf-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645521123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521123, "uuid": "49bd76fe-c748-453f-8a5c-751016d6056e", "comment": "Malware payload (Formbook)", "value": "cb276158f3624e3fed9786fd3beb3184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521123, "uuid": "3743d873-3f1f-41e3-a378-c14e1c76c203", "comment": "Malware payload (Formbook)", "value": "2b8099c7609f56157c7d2cb7e1da50b2ff85edb62e7599ca995a691b458ceb31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521123, "uuid": "50643b90-cafb-4b60-9574-fec4e006f190", "comment": "Malware payload (Formbook)", "value": "18130c5274260b0ffffa67da63b7f54307340ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521123, "uuid": "c352e02b-7bb7-43c3-9e68-e7f6eaca5d62", "comment": "Malware payload (Formbook)", "value": "5c7d8e7a83496d8d8ef231c4bd24c625febdef1ec2ffb62b2fa65c6c3cec17f0ca425354f27cd2bbbd3c91c0ff5c66d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521123, "uuid": "de65a6be-3f54-474b-9504-7af7ec3fd884", "value": "T16C4402DAF6C094F7E8860AB008BBEE3610F77D2E3A35159F971D7B2A9B730821056547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521123, "uuid": "2a80ded2-63da-418a-9eb5-4da141fe680d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521123, "uuid": "96a8d209-005d-4634-8021-40f632ad879a", "value": "6144:6xDtNuUdcU2RfWiQlx984k69UxXIlP/5G:qdX2/4k69UxYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645521123, "uuid": "ec18535e-879a-4bbb-bba4-ff57a665bd15", "value": 259790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645521123, "uuid": "ed5fee1f-45e4-460f-9688-e3446a463f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521123, "uuid": "ccd04f2b-d203-476e-8678-b458aa6de24b", "value": "DHL_22040 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d58146-9406-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645551822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551822, "uuid": "fd38051e-bd5c-4084-bf8c-9ff1c3ecb7c0", "comment": "Malware payload", "value": "68f843e45647eff83b6d0a75c2550585", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551822, "uuid": "d15c0d46-350b-404d-ac86-152cc1f4206b", "comment": "Malware payload", "value": "2baf5c03229c7dcdd5204b814fe14c3ba975feeb5d5bec6a96806cbd5b8c8276", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551822, "uuid": "4900be6a-f5ee-49a8-a179-52b6434d5ec6", "comment": "Malware payload", "value": "4017622ba4a66e4d3e34a3be4088cee8d7762c3b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551822, "uuid": "f9408c84-1e96-47d1-b6db-a1b77ea5b229", "comment": "Malware payload", "value": "d781c0c74637b97511e8c7957e31bb82a171c6f1d50e7761c0afc4f96ae91181a68deceba8d41b0ce301feb5f8dccac9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551822, "uuid": "e726f475-2bcc-4ba8-bf2c-e89c8913ff61", "value": "T1F5930769B681C95BCA5807344CD7CBF67227BC424E7A87473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551822, "uuid": "cdb3ca22-b6c8-4d65-a13d-568c0d17e795", "value": "1536:yyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQArkWvgrPE4nWHPNc2AZ:yyehv7q2Pjx45uoDGTj+5xtekEvi8/dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551822, "uuid": "e6147bda-2637-434a-a592-2ad7c2ea3568", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551822, "uuid": "5e9c40e9-f126-4bf2-b4c2-1b1d1713ed87", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551822, "uuid": "b81cc965-093c-4c3a-9639-fd483e46eac8", "value": "tmpa7tn1ps4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa3bf78-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645516076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516076, "uuid": "620da57d-4141-4393-bdeb-5c282fc33320", "comment": "Malware payload", "value": "a13d91c4e7478fdcaca13fd2c08c40d3", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516076, "uuid": "3210d102-6031-40f7-8f38-eecab1f15d03", "comment": "Malware payload", "value": "2bd06b1be1f1dae48625441fe305f6dab1a00744a1ab60b6289db5af55f9397c", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516076, "uuid": "f7459b3e-b7e3-4f5b-a639-a5b5ad2d7a1a", "comment": "Malware payload", "value": "64c67f941b6ab67e6b3b7ec74cf2f225289d4439", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516076, "uuid": "ba6dd1fa-a5e8-4075-bcc7-2312afffa11d", "comment": "Malware payload", "value": "f96fb2fc54add12eeab4d77e3d85743bb7ee218e008184cd32d94d389c8fc101a76cd93e478188374ac25c9214d7d0c2", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516076, "uuid": "8889cbe7-c871-44fb-987a-b09ad8eb41d7", "value": "T11923C01CC541560BC1A3693EC47988E0596B9C1BF110498FE5FABD8F06A8E9F178FBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516076, "uuid": "d968708a-1852-4cfc-abdf-02ca97243539", "value": "768:Y+1RD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTu:Y+7JqHt7NJECQFfqAu7I1/K8NytsRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516076, "uuid": "1a5067bc-ee5f-47eb-96a8-491dd19e9589", "value": 48034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516076, "uuid": "313ff671-2536-47de-bbc8-fa656f70752f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516076, "uuid": "11ba9800-3d3d-44f4-80ee-5f5c49e37c6b", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4c0091-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564927, "uuid": "e9414c9c-cdd3-474e-8d1c-59fbf6f52ad9", "comment": "Malware payload (Heodo)", "value": "e49a09a5c58e45ffd7599a458cc28ea0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564927, "uuid": "99a03948-bcf6-47c9-94e7-619de0e8c251", "comment": "Malware payload (Heodo)", "value": "2c0336371fb43ba05b3d39c686b0d7ea6df1c136a08816e3f126df953e6f0b37", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564927, "uuid": "943efd05-1512-4e6f-9826-2cdd42957df5", "comment": "Malware payload (Heodo)", "value": "ee358e6951084937b4fedd3cfe0b426cb04e16da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564927, "uuid": "9d72c22d-7676-497c-b9d8-f013c0b62aa5", "comment": "Malware payload (Heodo)", "value": "4cc99a8a090f6a1f5b3331e59ccd1d684cfa270b030317087528bd3b77af46d2138c398c4902377220610c59f0245d8c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564927, "uuid": "570ca043-37fd-4569-a2db-e2bc29e7de9b", "value": "T18EA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564927, "uuid": "8ba6808e-b6ce-4b9f-8cce-b354b7670562", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564927, "uuid": "984b1466-2e6d-4add-862d-39914587caaa", "value": "12288:vicw4w2Vb0zq6k5Z2mTLjqkGXNrGHORQuBT:viSwub0W6LmTtwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564927, "uuid": "0f14c5de-e43f-4e83-b150-9a750977a25f", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564927, "uuid": "2e68479b-81c1-4a17-a7ba-efcac2126cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564927, "uuid": "da7d972b-edcc-473c-9e7c-a3160504bea9", "value": "Ur9NPMc0Q0sxKsifHoYQb5UIyLZodg1f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2d2c6f-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "64796d4c-0df8-452c-840b-d2b9bd690729", "comment": "Malware payload (Heodo)", "value": "bab12362bd93ffffe06db54d9787a81d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "6e1bbaae-8669-4470-bb98-ebe57d1777c5", "comment": "Malware payload (Heodo)", "value": "2c07f3d59099e175c5958c11378b57dc55c6c550ab086ec3d5c873b8f2a21375", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "b338effc-da44-41dc-a2a1-0df5602cd2bd", "comment": "Malware payload (Heodo)", "value": "ddcdb484c629bf098c7a97f055cab1a31d31f417", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "c94da2a4-f32f-434c-9e30-1f5c1b424203", "comment": "Malware payload (Heodo)", "value": "c9c2c6744c5fd246ed416e81855aebd05ef120aad01d2bf05f67289eb400eb6c3c88e83120a38ba5b640d3ecdf97e50d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "7534faef-1f32-4fd6-ad83-b0f1d1e19373", "value": "T1E6A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "6fb8236f-0a36-47cc-bb3b-54ecca694e73", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "9cc774f5-c27c-47fc-8199-78f58d214c0a", "value": "12288:vicw4w2Vb0zq6k5Z2mTtjqkGXNrGHORQuBT:viSwub0W6LmTbwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549943, "uuid": "62663d00-623a-4c12-a6a4-eacabfd0bf89", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549943, "uuid": "223dc7c9-27a9-4166-8fd2-2f544bebbe61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "8a7942d5-2fd0-44d6-888d-350ef44a9e0a", "value": "emotet_exe_e4_2c07f3d59099e175c5958c11378b57dc55c6c550ab086ec3d5c873b8f2a21375_2022-02-22__171217.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a3418c-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518317, "uuid": "83ff3bf5-5392-4836-9080-326ba3582968", "comment": "Malware payload (njrat)", "value": "38cc4a20b075658dc57ff4edfa1ba524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518317, "uuid": "3d7d1389-89e1-47be-8d32-72099dc18117", "comment": "Malware payload (njrat)", "value": "2c2e348adc48192c9e034cee3867b1437e716751e6a2ccb82961f344f415e0e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518317, "uuid": "bcac303f-ad4e-4d89-9c9a-4acb28160533", "comment": "Malware payload (njrat)", "value": "be582ee7f3c14cc3f967fbace0eaec93df9cc047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518317, "uuid": "6997b74b-8fbd-45df-9d20-3ea70cf018fe", "comment": "Malware payload (njrat)", "value": "e01aa9ae97c48fe685e9e62dfd30671abbfc1ebc94f572c5469c0fc339f25f2ca9216eccd4e11feea2553cfd8f911320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518317, "uuid": "5237254f-a74c-4be8-bcad-4e19efee3e31", "value": "T12C032A4D7FE18568C5FD067B05B2D41307BAE04B6D23D90E8EF264AA37636C18B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518317, "uuid": "5d346d57-d06b-4126-ba4f-b763ab91b208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518317, "uuid": "79c6f89f-b626-4155-9a25-368276999872", "value": "384:q0r7cyyaikXhkdTnNiybYTur3nycs/4zQrAF+rMRTyN/0L+EcoinblneHQM3epz8:fYy8xNxbYTurid4srM+rMRa8NuM/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518317, "uuid": "3b2c94f3-9507-4172-b19a-23725de7f754", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518317, "uuid": "68a64bd2-00ec-4865-95ec-7b5677e389ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518317, "uuid": "e7554673-acd2-42b7-85e7-1cc6ccb8be52", "value": "38cc4a20b075658dc57ff4edfa1ba524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b432dcb-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503909, "uuid": "e124edda-eda0-45c8-be18-b0d224e0d942", "comment": "Malware payload (Mirai)", "value": "2ceb9372d60fda9f5c929e849b4c0c0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503909, "uuid": "e3e69581-ae97-4d4d-ab2a-3596f5ecbd79", "comment": "Malware payload (Mirai)", "value": "2cb16a7c0342d935d1d4b591b2a88d60cf97c0b98a424df770f1e58cd560ab00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503909, "uuid": "1a62db42-61d4-4f94-980e-e8fe3ee53c39", "comment": "Malware payload (Mirai)", "value": "f13ed1fecce6eb2510b27286ace9682284dd6c0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503909, "uuid": "3fb2f998-08ee-41e1-8c34-493e059d850e", "comment": "Malware payload (Mirai)", "value": "06a48c993e1e41188cfd4861cb9aa4e4d47331cf4589f5d27e2e5734c96e01aca825ec100ba1c2cd2cc415b1832649e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503909, "uuid": "8cd9cf9f-a891-4e06-80c7-85790045f71f", "value": "T1026302C2E81E306149900EB2DBA057D6384B1BFBC1BC55B607AF6158BD877E113EB5A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503909, "uuid": "40dd9b03-c373-4daf-a5ed-5799f3bcfa5d", "value": "1536:oWhXZbIuzBUsn9EBooagm+Vki5h09FiXehWALym2hUtiQPcZUD:lt6o9noHbUFiX9ALd2kNPoUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503909, "uuid": "bdbe25ce-5f28-426d-aaa5-512736bd3d5b", "value": 70576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503909, "uuid": "ce4fb929-06f9-4270-a472-9c90e78418f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503909, "uuid": "3bec23ff-9465-4255-86a2-6ef21f7d4b31", "value": "2ceb9372d60fda9f5c929e849b4c0c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a79071-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550451, "uuid": "bb09c1b3-f9c2-4ec9-8c6b-6825e7506081", "comment": "Malware payload (Heodo)", "value": "25c97f54eecfe912ead2e10c5e1a5782", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550451, "uuid": "667d3f85-e14c-43db-b20d-10931cfb9eb3", "comment": "Malware payload (Heodo)", "value": "2d0d739466085c6fd88192a979943deee22e1312843bce598dcd2d4ad9f53b0c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550451, "uuid": "741a1ba0-7978-41a3-8c35-63b67eb224cc", "comment": "Malware payload (Heodo)", "value": "ec41807d02f1f5307cdbb28b89b9eda8c18fc5d4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550451, "uuid": "34becdad-44be-449e-b21e-a259592e7f06", "comment": "Malware payload (Heodo)", "value": "ec03ad56f692d405c9237505a4f59f220ae7288600cc544eda522b73102e8a0b76877acdada4d88c4df333742ad6e096", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550451, "uuid": "bcea015d-35c0-4527-98c8-4239d462c7ee", "value": "T105A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550451, "uuid": "f2432f46-1e43-452d-9571-564daee5e139", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550451, "uuid": "e8d04c5a-b928-48ed-af23-e0fe1acbe15b", "value": "12288:vicw4w2Vb0zq6k5Z2mT+jqkGXNrGHORQuBT:viSwub0W6LmTqwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550451, "uuid": "641e864a-f459-4af5-aec8-7b756f782f72", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550451, "uuid": "307f4c8b-2086-4a76-9713-2f3e04d412c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550451, "uuid": "64be254c-4271-465b-bca1-6a1fcaaf6d03", "value": "JgfB5YrAvE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4d8f97-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554883, "uuid": "b79fd392-69ea-4072-a727-74ba8bc4b161", "comment": "Malware payload", "value": "3fbbaee606b9fa5ed730aab0c6123ce0", "object_relation": "md5", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554883, "uuid": "2f49c31a-0a7f-4701-aead-85fe555f84cc", "comment": "Malware payload", "value": "2d89ba4be26780c15328677895a43b6b31791a25105892d562cacf7fc902299d", "object_relation": "sha256", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554883, "uuid": "f8ab21e9-d442-41a5-8c85-74caecee5799", "comment": "Malware payload", "value": "a38435566b572cd77b2b5521cf50d830518ba9cf", "object_relation": "sha1", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554883, "uuid": "88c72ac7-d975-4bb5-9a07-ab080f47f639", "comment": "Malware payload", "value": "6ba17fc4c98067492033cec4176bead2bf9f3f88afa59e467e6841e6f9298dd7ae2eccbb09fc063070a3720ffffb100c", "object_relation": "sha3-384", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554883, "uuid": "d1cb7e46-1cdc-49d1-a7df-c94077585ad4", "value": "T1BFD39821BD31B667AA85C25E345942EFF51913D3B390187533EBE3689148CA6FB8F708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554883, "uuid": "cc0a45b5-776f-4753-a6c3-6478b1354f80", "value": "3072:GC3XSxzT6zNQety3ZUOB6JD0FSB9foD13ZE2QgppNVeM0suOgcTm/N+J/rr2UJro:GC3XSxzT6zNQety3ZU8s0FScElK7LmFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554883, "uuid": "5c153908-ae9d-4ff6-a2d6-f4cb85df0501", "value": 133278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554883, "uuid": "dcb5ea86-3704-42e7-86e3-08dd6ec97ef7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554883, "uuid": "a6b31db9-39ee-402d-97e0-f04c188197a5", "value": "WZQNBDSLVGAWPUXJRUVDYE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad45289-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555072, "uuid": "74ae096c-3258-4348-abb7-49a9862a4d62", "comment": "Malware payload", "value": "b90b267d4c8a0f66bb8159d6f6b6edce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555072, "uuid": "ef6cf647-6147-44e1-a211-511f48345a7a", "comment": "Malware payload", "value": "2db3dfefeb3a18618a3b32c583d132f774d93acad5ec8f38eebc72da519220a1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555072, "uuid": "2c944afc-1129-458b-beb5-a99b6554178b", "comment": "Malware payload", "value": "5e40e5fe3efae7aa86df7302bf6bf1db2ce32d21", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555072, "uuid": "6677be93-3197-49f3-9b2d-82bbfd04d540", "comment": "Malware payload", "value": "ecfa19b8886776dece54f93a6e67ca6993498123ba49514e8b3a3f854769a6744260ad1c072da84f09bb2bd0e3da9610", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555072, "uuid": "70c3ef2c-d95b-4364-9f38-fc19635d8bcc", "value": "T1BB930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555072, "uuid": "d318e837-7af4-4692-9455-019cd24ef1d0", "value": "1536:Uyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGdkWvgrPE4nWHPNc2Ax:Uyehv7q2Pjx45uoDGTj+5xtekEvi8/d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555072, "uuid": "e2a7533a-9b65-4e48-a426-1094faa16538", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555072, "uuid": "24ada167-0686-482f-b4cf-bbf5729b9667", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555072, "uuid": "87f3fb95-3515-4351-825c-51122ce8f421", "value": "tmp6gm85mvy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08ac6d2-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514333, "uuid": "9ae34a2a-16b0-498b-bcc2-45f11d4c3f50", "comment": "Malware payload (Formbook)", "value": "96d83ce629445d8534e77eeb35d19c56", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514333, "uuid": "cb235f8f-e4be-4d28-bdd7-0af2ecb64cd9", "comment": "Malware payload (Formbook)", "value": "2e2ff6465fbc6043dc75bc1d6d15144fcc51f7860333f208cef6ec4c098f856e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514333, "uuid": "81b1d58d-8d62-48e4-9a7e-8604b12d2548", "comment": "Malware payload (Formbook)", "value": "7add8952900d884d16ad7ebae1b97e97f4fae534", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514333, "uuid": "08eadb11-2a06-45db-8373-4b69223a5c35", "comment": "Malware payload (Formbook)", "value": "71ab05f17433c2e7b980a8c4483aacc8fcbd5f29180fbfe5ac73963d99f0c7752dcb8e55caf3823c794062643bae8e76", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514333, "uuid": "7104984b-0ae1-48a3-bf61-88295679e0eb", "value": "T1161402913661872DE24A75BB41244CEFFDDCDE688A3A2D243601769324F06FF8851AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514333, "uuid": "90fda7d4-9520-4ea1-ad2e-2f5f8972e45a", "value": "3072:PDm2iTSKPyayuXwSDEKNJZSMWCQwWyc6nyrvC+LUIAXTlJokHEMymXsKm4A2e+m:q2OSSRXwSDEjXvfG8C+LUI+Tl+kwmABv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514333, "uuid": "e217d12b-e2d4-4425-931f-ffa22322354f", "value": 191944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514333, "uuid": "6bf24c45-1a99-4390-a8c4-f85027cc4288", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514333, "uuid": "bdadfd14-9651-4371-b73a-7e768fda81c5", "value": "S28BW-421122909390.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedb369c-940a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645553414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553414, "uuid": "884c7c4d-8a9b-462e-98bd-d39d6d9818bb", "comment": "Malware payload (Heodo)", "value": "2e284613ea5c9b3c261bb3c6626a465b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553414, "uuid": "16edd032-a174-4858-bda7-63689d7eedc6", "comment": "Malware payload (Heodo)", "value": "2ee9cf661370033cf7e28260de85a7668aac6723d36f66f9ea4310dc8d9e796d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553414, "uuid": "9c46f70f-8f16-4988-9806-d1d96083c3bc", "comment": "Malware payload (Heodo)", "value": "d0e4484efe7da9e07b6f51822ef4ab871e0d7ddb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553414, "uuid": "98c9eea7-ef97-4e84-b3ae-c9d97bda24e1", "comment": "Malware payload (Heodo)", "value": "ff3e89b479fc4392dea3962965779b1ca4f0c998eb467be8496a440dd8b40d0ba6a269a387d7e9e695ae203e9189f191", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553414, "uuid": "e4f9dcbd-a305-4da5-8557-cc97f7089b1c", "value": "T162930769B681C95BCA5807344CD7CBF67227BC424E7993473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553414, "uuid": "47e216f2-4915-4c43-a833-442c0b5381e8", "value": "1536:6yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQs1kWvgrPE4nWHPNc2Ak:6yehv7q2Pjx45uoDGTj+5xtekEvi8/d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553414, "uuid": "6adce887-0e4f-4aaa-86c2-5d6d35a6bbbd", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553414, "uuid": "ecf005de-53a1-421b-bd5d-49a6fa2431ec", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553414, "uuid": "e13993da-929f-4283-b8ea-fd2791b25c50", "value": "tmpkflua13d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06bd8e0-93fb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645546974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546974, "uuid": "3f489cc5-a771-4bf8-8e42-fa39e9916f5e", "comment": "Malware payload (AgentTesla)", "value": "7c3b18603426c0c423265fd480469ba9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546974, "uuid": "bf75da5c-7803-4c28-94a8-4870d3ce9fa0", "comment": "Malware payload (AgentTesla)", "value": "2f0da311ae106b9fb943e542249605344eeead96d15cbad8579afe1d34556faf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546974, "uuid": "347b2c6b-d45d-43ad-910a-0fa7d2dce4dc", "comment": "Malware payload (AgentTesla)", "value": "ccb4aac87e90f8b0d9b4a4618076251f0b9f184c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546974, "uuid": "ec465f8e-86a4-4c24-826d-8e2b18ead8ef", "comment": "Malware payload (AgentTesla)", "value": "ef9f2380734a265d1eebcd89e8e7cd2542074e1b449713ecb50998e2841594e4298f23a5e1ff523616ab10d7a5057e0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546974, "uuid": "be173fa3-645f-437c-a57e-833ae2bfb112", "value": "T1BFD46AA021E6CBB5E4F853B8F42240F60FF07D1ED615E52B3DD43E8931B2E5156A3A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546974, "uuid": "0082ad54-02c8-414c-bd04-ef2f587049d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546974, "uuid": "f2271967-1168-477c-9ab4-de0ad547f8a1", "value": "12288:aYRYP04TVfKbhWj8G4ipkxSqqoYzqpRK80OAk89ieHh:bRn4xib0gxiCcfNgRK8P89FH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546974, "uuid": "ab2be9d2-b4f0-4adf-89aa-4d001efc913c", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546974, "uuid": "58a200cf-a645-463e-9bb8-bf3fc1aee260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546974, "uuid": "36eb5372-536c-42f4-9c21-4601202c2649", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43c9b53-9431-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1645570281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645570281, "uuid": "90b86625-f078-4542-aeaa-e7543265a4f8", "comment": "Malware payload (DanaBot)", "value": "06be7147faa9333dde2aa100d7cb3b0c", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645570281, "uuid": "35e37f69-e4c8-4c60-8ab8-30772d1be507", "comment": "Malware payload (DanaBot)", "value": "2f43972540a6cae0eb4e50d142860bdc278b44b9b4606747c58e19383efa82f5", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645570281, "uuid": "11b52f26-950b-4198-99a1-95954572ead2", "comment": "Malware payload (DanaBot)", "value": "e35819d29b2f5d9b63c65c1541eddcd92ac59125", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645570281, "uuid": "f5ae76cb-585b-4ffe-a63c-75d3bb439bce", "comment": "Malware payload (DanaBot)", "value": "9317a1cb7aec7b9c6e7b9c9cc727a0d412f461bd43351a7066d38d04ed1bf0f621e5d0b733e8ecb8dd6c71dd60c7cb42", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645570281, "uuid": "6b5d0603-143c-4e4e-a21f-a3fc8258f080", "value": "T1763512D076A5E872C500AD34841BCEE5915FAC11CA54968FF2B8BF0F6B322D161A736F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645570281, "uuid": "b77ba404-a203-4812-b011-685f3476293d", "value": "ac28fe22f41d923696527394756551aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645570281, "uuid": "2fbbf266-a320-4a34-a929-a1c3a05294c4", "value": "24576:0HVnxGkMT8iCjnQGQpzjoLQBUVW2h8NugMzpo6aS1T:0BxGkMT8iwQGBLaUVRqNuNLaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645570281, "uuid": "e75cb15c-291f-4749-a066-418709dd64f9", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645570281, "uuid": "51977927-7703-457c-a940-1c7c4f4e30d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645570281, "uuid": "ff3be71a-cf71-4d08-bcb1-1793e9f26be0", "value": "2f43972540a6cae0eb4e50d142860bdc278b44b9b4606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19aa24be-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645514080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514080, "uuid": "4361e1a1-49c1-460c-aa68-9615abf2c2f0", "comment": "Malware payload (RedLineStealer)", "value": "95b4131e422b715ab321525829cad1f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514080, "uuid": "aa74f72a-ac85-4d31-af87-e67c64fe62a1", "comment": "Malware payload (RedLineStealer)", "value": "2f46ff351a0ba5bcb453edd9f1b8c86cab39d677bbecd306cf50ca7fe19e8f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514080, "uuid": "3e141039-9784-479c-bbc5-1e355e178d77", "comment": "Malware payload (RedLineStealer)", "value": "d11d4fd6f6b315c2164a261f7c04c7b430bff481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514080, "uuid": "91ddeac9-96cf-4afc-87cc-c63098e29ff3", "comment": "Malware payload (RedLineStealer)", "value": "b3e42e6cc7aa81616eb65cafc38134a8d92e991c038b7364a7bc0721d99a49604c6f62361124111ba78c47d69ca6678d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514080, "uuid": "5f7df572-8381-4701-89ef-9aa85867d66e", "value": "T1C8363373156C681CCAA78C7107CCF701FE54A276F7D2F4C983BD0947922526BE9AE1A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514080, "uuid": "de334170-f5a5-497a-bba6-0404fc66c7aa", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514080, "uuid": "9fbb8c61-f821-464a-b0ac-df5faf08addf", "value": "98304:hNAk4MJfvYy3eVGlIe3CxzfLOnRInjZbf9mhrMnPXwTx:zAbMFYy3eVKD3mORsjZbgMYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514080, "uuid": "59bd839c-bb68-42de-b97b-401045d9dc81", "value": 4870448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514080, "uuid": "27595e38-863b-432f-b752-113b17129960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514080, "uuid": "5b024e36-9edc-4e1d-8908-f3f101456500", "value": "95b4131e422b715ab321525829cad1f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f7b728-9420-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645562761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562761, "uuid": "18d01b53-f403-4733-907e-b8efc61716f8", "comment": "Malware payload (Mirai)", "value": "c1b38783f22512ae29896bfe7ba6906e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562761, "uuid": "1c63f658-dcd6-4f18-872c-85f919dd92b0", "comment": "Malware payload (Mirai)", "value": "2f5103cf556d78a2be6cc6586f0b92b413016c41825fc525d2ca1211d83bdfb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562761, "uuid": "90eea466-ced9-4734-8fbc-c2b59e4979dd", "comment": "Malware payload (Mirai)", "value": "83b14b8762bc292697b6940c3502e36467b39e5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562761, "uuid": "406d0268-7846-4943-a0b4-78c5a5102279", "comment": "Malware payload (Mirai)", "value": "9ad84e9f1cab7a25421162e71b49e74ca688c317ca9701370c0f50547ce7eee7563d5e75ece155f6cba186cbac4eb2b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562761, "uuid": "417e644b-fedf-408d-8ebd-767fcb8e7909", "value": "T14B03021AA06D5CB6E170583FE2EC0A5F6B85B7FC67A9301100E005BD2781E6939FD4CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562761, "uuid": "3d0b30eb-a21e-492e-be6f-5741e7428349", "value": "768:CgizYis9CvYOCVwucgjsgRUxtq1jfwjCwi+DIB1QmxF9q3UEL7E:8wCwO2zcgTUHIfQKG8ULQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562761, "uuid": "4c6ad755-6344-4924-9b17-cc07f2ac96f2", "value": 39448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562761, "uuid": "b686a0ee-6f08-4d08-b44e-83eb00ac96ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562761, "uuid": "a4ea1182-7329-4a65-acd7-cf149cf18cbe", "value": "c1b38783f22512ae29896bfe7ba6906e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d94812-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514743, "uuid": "f4957435-2221-43eb-a67b-341a4cdd0e27", "comment": "Malware payload (Formbook)", "value": "91226bb32749ba1b5754dccbec589331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514743, "uuid": "40828cbf-33fe-4548-9884-3b8e48609c4b", "comment": "Malware payload (Formbook)", "value": "2f5f6db578c19a5a380e6e95f5ac284b348d2cb1a28b980fcc3596852e25f618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514743, "uuid": "44517e21-e0ea-4632-b8ca-2358a736d4bd", "comment": "Malware payload (Formbook)", "value": "98c1a799a677468e73f4c0d8a7fe90ccd241f956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514743, "uuid": "984115d2-02cb-42dd-8b8c-00ff0a71d588", "comment": "Malware payload (Formbook)", "value": "b97e0492d2be286f9ad0e42597a84adea7e7f369b4c9834a46997e6669e13d3feddc7c3b3329e62c3e69fb35b6e5549f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514743, "uuid": "93068de4-8878-4ef7-860d-a6455b794b2c", "value": "T15FA45BEBEA4110E8EC3A177124760D65627BBEBEE4B8711D2A5D723069F31A3143394F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514743, "uuid": "5540c0dd-eccf-4aa6-9c89-cd8e1d85e505", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514743, "uuid": "b420d253-f27e-4591-9b86-3e9962fda07d", "value": "12288:2AP7fsoNDtA7zFYxsSpoyS7SQ4LN9m/1vaw5yv+lVxNC8QF7Bv0:RJNLplN9uv+kC8Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514743, "uuid": "c3c11992-be93-475f-89df-d0e6ba19ca28", "value": 471741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514743, "uuid": "bf0e368d-d1a5-470e-bd9b-92739eff2bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514743, "uuid": "9e7c5b51-a5fb-4c0c-9f52-175c4cbe0ff3", "value": "EFT DEKONT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea6e9a2-940b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645553682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553682, "uuid": "68f38b6f-46d2-4dec-9fe9-8fc4b766a5e6", "comment": "Malware payload", "value": "e39b5af4024e00279aa8efff55c0ec5e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553682, "uuid": "f3e39b7f-855b-4edb-a2e2-33ae67c72298", "comment": "Malware payload", "value": "2f80074966f001f6d1960caf7a0a31d7373b8623ac2d655e6f8e72c617f46f08", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553682, "uuid": "0babf896-fe7f-44dd-a815-772a8bedfb83", "comment": "Malware payload", "value": "f0c9ec3db168e081b613f6a0c992e2bd1388016d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553682, "uuid": "2f0f8a51-0a8f-4b8b-b6bf-eda99467f5ae", "comment": "Malware payload", "value": "e081055a92681e40329ae107235153b47e7b7480ab3aa823976bb4180a570817c7bbdfaed7c6166ad5b8d2e2ee75703f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553682, "uuid": "baf0bf6b-8bc8-4d08-b821-c0c50e744ea6", "value": "T130930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553682, "uuid": "b3131811-df40-472f-b4ba-4831554892ea", "value": "1536:dyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQsRkWvgrPE4nWHPNc2Ap:dyehv7q2Pjx45uoDGTj+5xtekEvi8/dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553682, "uuid": "ab2a134e-8c9a-457c-9f86-70c2a90ae3da", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553682, "uuid": "d640f096-55df-4177-8a66-63f94ba7366b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553682, "uuid": "388b40c8-856f-4dac-8896-d1671c4f6cfe", "value": "tmp9edf7zzk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac06a9a-9408-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552360, "uuid": "3c9be7d2-1061-4e2d-8bf5-76812fcfb9b3", "comment": "Malware payload (Heodo)", "value": "904e3bc9d2c2d710626ec0ccd15ca5b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552360, "uuid": "1b151727-bc3d-4202-b1f8-f8bf4c3e23cf", "comment": "Malware payload (Heodo)", "value": "303f80a4d34f187d06699e50e5d9997b6cc563ef00675da1ebd162c120cd6c37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552360, "uuid": "a4aeb30f-d3a1-405f-8460-22df992dc2e7", "comment": "Malware payload (Heodo)", "value": "c19d44f801c63297ece99741038ded5864300318", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552360, "uuid": "d911d7b1-1936-4941-9588-f7dd7e9e5bc9", "comment": "Malware payload (Heodo)", "value": "def1a72dd5901fecd0ffc44112178403d25dd414697abdeeb78a88e431837f9219df2e6da3154e197682df236251ff2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552360, "uuid": "420c9d68-53e6-473e-b879-754f54cb6652", "value": "T109A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552360, "uuid": "e33b59dd-768f-4a5f-a25d-51704e5d1410", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552360, "uuid": "5a4bcf81-492f-4148-a867-d4dc8e7ed3ad", "value": "12288:vicw4w2Vb0zq6k5Z2mTFjqkGXNrGHORQuBT:viSwub0W6LmTTwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552360, "uuid": "4097c3f3-269a-4f3d-a31c-3abc100513bf", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552360, "uuid": "275e50d3-39f7-46e1-9333-3008e93703da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552360, "uuid": "c8867e24-691d-4df4-ab82-6d43c5021cc8", "value": "904e3bc9d2c2d710626ec0ccd15ca5b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a9ff9c-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554048, "uuid": "1df17f1c-ae7c-4ceb-ae3f-3d43494bd353", "comment": "Malware payload", "value": "e6b584544e9d824c6ee98fb9db07561b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554048, "uuid": "a191337d-eb4e-41d2-9da8-1a3c6b8b573e", "comment": "Malware payload", "value": "312cc1089163287ad69b1b36e5cfb6674806ae9a7f6a862531b615aa899df859", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554048, "uuid": "0945ede4-793e-42e2-aa28-b9840d820d8d", "comment": "Malware payload", "value": "432d798b73458e1f522e5e9b8a9da4163b28a172", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554048, "uuid": "21eaf5ac-5072-4088-9d3c-11a162bf2d6d", "comment": "Malware payload", "value": "89b77883c96de6e8b6ee897a7ead34862561cfbb02a1f4062f0f5f3d966d758a1936e1611afdac99567734511daffa53", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554048, "uuid": "f2a4e24b-0e2d-4d25-a950-6adff6264c48", "value": "T14093F769B685C95ACA5807344CD7CBF67327BC424E7983873298F32E2EB7650DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554048, "uuid": "01ca0c21-ebfc-41bd-9e1e-f07f0731ec68", "value": "1536:Lyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQsnkWvgrPE4nWHPNc2A1:Lyehv7q2Pjx45uoDGTj+5xtekEvi8/d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554048, "uuid": "77013c1b-fc04-4fca-9e46-1682c92afef4", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554048, "uuid": "9b4138f0-4dc7-493d-b2ba-0288c8a0b23b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554048, "uuid": "193c65a9-dee8-4b0b-a1f6-f42791181512", "value": "tmpirlvmg0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1f90e4-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645518375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518375, "uuid": "c2905151-616b-4797-9152-3de99a26033a", "comment": "Malware payload (ArkeiStealer)", "value": "1da1a260d999511a576938a721a9b3a8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518375, "uuid": "32507f67-4408-44b4-a3ea-43569fb594ee", "comment": "Malware payload (ArkeiStealer)", "value": "31fabfbe61fdc161c12c62ec848d558cce743de39b58cf634910bd6fb305f22d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518375, "uuid": "e88962cf-3e29-4501-b651-b9143b9eebd2", "comment": "Malware payload (ArkeiStealer)", "value": "18662532144e1c35b9041aed877b7d12a95f36b3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518375, "uuid": "5b07d596-011a-4c69-b8b9-cb71f7dd8282", "comment": "Malware payload (ArkeiStealer)", "value": "e674f479e8ef647db998e5346117f0cd900dab26f2ba2f3fd749eaebf41b0d4a4a2ebfd3a85e4fe7e58fa8e438fc4884", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518375, "uuid": "0a54e938-6401-420e-a7df-0f47fc4feff0", "value": "T108D41200B6E2C875D9F64E31A436D296973FB8619D21A45BF6A8BB5F1E303F11B30346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518375, "uuid": "7e94f91c-f143-4430-9ecb-ac1bf385433b", "value": "c69428ec8c7b96b0ee501e7dab15951a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518375, "uuid": "3b022b76-8822-4790-9ad9-c813a9f1677a", "value": "12288:FMalzor+85kxU7oG4tm1/NqEwtfF2o5I7vk:xJTJmgKw/35k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518375, "uuid": "fd7d768e-2584-41a7-b70d-e0bc5ad5a228", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518375, "uuid": "39dcb194-52de-4e72-a216-72ca7bf009bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518375, "uuid": "cfa55eba-d631-41f1-b406-e41a24b10f77", "value": "1da1a260d999511a576938a721a9b3a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9891b66c-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554236, "uuid": "93948cd3-acc5-4867-8908-7fe1d7a95952", "comment": "Malware payload", "value": "327fee2e572cf6b3b337fded32308189", "object_relation": "md5", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554236, "uuid": "c791d08c-e263-4e6d-a1e2-b0332f00c56c", "comment": "Malware payload", "value": "32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559", "object_relation": "sha256", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554236, "uuid": "3a6f50fc-e70a-4109-84a9-f17ac0f6c0fe", "comment": "Malware payload", "value": "8046a0f02d0673d3833b40bc5ac885b0a8891079", "object_relation": "sha1", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554236, "uuid": "142ce2a5-ec69-47e8-adac-6f2efe8c771c", "comment": "Malware payload", "value": "fdc1a85b447adc670ddc65c6d73923348d8105502fd53c5f3df593a8201878c72f89e3a560906df6a57b33b7e2ab9eed", "object_relation": "sha3-384", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554236, "uuid": "6d1907b2-5699-4a7c-9a8b-1c30f14f8261", "value": "T1CBD3BA21BD31B667AA85C25E345942EBF52913D3B390087533EBE3789148CA6F78F748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554236, "uuid": "f2b984d3-813b-4688-8af3-54c38262c468", "value": "3072:xC3XSxzT6zNQety3ZUOB6JD0FSB9foD13ZE2QgppNVeM0suOgcTm/N+J/rr2UJrj:xC3XSxzT6zNQety3ZU8s0FScElK7LmF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554236, "uuid": "8307e941-0ce8-4cec-a0f8-a5e478e84df2", "value": 137943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554236, "uuid": "29683716-9f86-4a3b-9923-c2ee567c32d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554236, "uuid": "a768ab69-6f6b-4c41-9f68-dde1c89fed2a", "value": "ServerFAH.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81161305-93d1-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1645528856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528856, "uuid": "ed327467-15f5-41e3-b2b4-210aa7a9c42c", "comment": "Malware payload (AZORult)", "value": "e5f2f306eff599e7c5cd3f54be721bcd", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528856, "uuid": "d0d0324e-ca5a-40a8-b8e8-52ee8f4e14f2", "comment": "Malware payload (AZORult)", "value": "3208b7940ca3be4d50228edd4d1d2b0f4a21df9d2e84d25a41c75ac074936215", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528856, "uuid": "4f23957a-a05c-46ea-8dae-df29a9570305", "comment": "Malware payload (AZORult)", "value": "3ab9fe4cc977d90a93f2011d29b0856604d3a345", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528856, "uuid": "af37d729-7f42-4bee-b7a2-93920cb5e322", "comment": "Malware payload (AZORult)", "value": "3d89503ee10606db3e669c4109e53674323567ca98dad626ee08c3e6f8ff71575e2b0009547c3ab4fd29394845cb2ef9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528856, "uuid": "d46b06cf-a08e-4cf8-b4ed-c1003e160180", "value": "T133253A9D365072EFC867C976CAA81C64EA60747B931BD203A05312EDDE0DA9BDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528856, "uuid": "521675cb-5939-4233-8ec7-dabe3e365890", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528856, "uuid": "094ac42f-e1a8-48e2-ba53-a8d85b6ccfc5", "value": "24576:A0EMh3C/D8PaR9VblYWENLC0qCtMtA9AO:A0EaF0VblZENm0qCkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528856, "uuid": "aa8db982-8d6f-417e-9280-1be519ed14a8", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528856, "uuid": "942c852f-097e-4fc1-91d4-f75e09bd20d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528856, "uuid": "2c289358-a73a-40e8-9712-ac3d32fef5fe", "value": "kendrickzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb80267-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514110, "uuid": "7661f80c-4bad-44b8-911e-e3479e597314", "comment": "Malware payload (Formbook)", "value": "7ab6abc412057d3780172e66dcdb2488", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514110, "uuid": "d05ec4ce-c178-4cac-b15f-937679ed43cf", "comment": "Malware payload (Formbook)", "value": "323198f5a6abafa03d0eae8d58eadafd8620d1c60f7a5c7b78959681cc6abaa0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514110, "uuid": "dfea7943-6a5d-4306-9c5d-89eb38118895", "comment": "Malware payload (Formbook)", "value": "43bff1e31602a02c689b263b799e9e808d0602ee", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514110, "uuid": "8d6c08d7-1ecc-4a89-8f2f-96bf23fab405", "comment": "Malware payload (Formbook)", "value": "5079de53e66fb4d8f4598a3388d59adb1752c0c4562f4eb4a3d9d501b3f3503844dabe3fbdbf91a58e79c644e26c35af", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514110, "uuid": "df14b499-78e2-46cf-98d7-9c25175a2e4f", "value": "T1B495A832B1317A87C3161461266FBE86430CBD47B2C65F8D905DFBF82CA6CA79306D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514110, "uuid": "912ca197-9586-46b4-9e7e-105b4b303e72", "value": "1536:qb8BvB3egene/enePeneceneYeneueneZenePenegeneSeneweneEeneUeneuene:cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514110, "uuid": "d9a87125-51d4-4cf3-aab7-fa5c842ab3ea", "value": 2051526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514110, "uuid": "05f3918b-941e-471f-98b2-ec85b4b9c381", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514110, "uuid": "fa187d29-76ad-440a-9e06-48900df2fef8", "value": "inq02212022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a37f7e-943a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645574100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574100, "uuid": "93f3c42a-377e-4656-9edb-2746a324a11d", "comment": "Malware payload (RedLineStealer)", "value": "c3b5ba786e0e2a87068939d2b6271130", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574100, "uuid": "398963a2-d9b7-46fe-b34d-b58fdfa5636e", "comment": "Malware payload (RedLineStealer)", "value": "326f03af3ab7295abcb2f5ad4bee946c7c1ca23a70b3bca491313d6a5809b4f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574100, "uuid": "c9f80da9-a783-44c4-81e7-eb2f1dda9849", "comment": "Malware payload (RedLineStealer)", "value": "14db8569773be3ca49c96015650a0d905b905119", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574100, "uuid": "78bb595e-d03f-4865-854e-28c2695ad3a5", "comment": "Malware payload (RedLineStealer)", "value": "74b6e354229f1f8a4a1481419d98f5a1e4d6e547cffbcc2bfee0dc99d22e8660014004a0c11e356c84078a72894fc216", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574100, "uuid": "2dbaa4c6-d74f-4ea8-a2a8-7f4fcb4f7fb0", "value": "T12A3523C2FA40D390F6BD43F0947B5C605A793EAF99A0224EB365B60547F3167192BE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574100, "uuid": "332ea9a0-167b-436e-9949-c78d03911865", "value": "536bedd01eca49e595eb847a30edc844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574100, "uuid": "7b73bfcc-785b-4924-8a18-a941052e81f1", "value": "24576:X8cOCYerndLG1qupryaKsQced5NsUprgAoQeLeKlHfBtKZJf/m:scfRdLG1q4msQcm5NLpkjQ98+7f/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574100, "uuid": "f3798565-1c08-434d-bf3d-b91e7e4f7023", "value": 1163104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574100, "uuid": "c34cc569-dfc8-4681-8eea-e234e6bb9368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574100, "uuid": "1921a271-42bb-49ea-ba9c-c7e0a95f2e42", "value": "c3b5ba786e0e2a87068939d2b6271130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56428e5-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550445, "uuid": "4e825d84-ef0d-47f8-bdb1-2a243da8c221", "comment": "Malware payload (Heodo)", "value": "aff88295aa63645eea462588ac02ec14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550445, "uuid": "5da761be-12ad-4836-9c61-708c01ea0acd", "comment": "Malware payload (Heodo)", "value": "33213f7d20028e079babd2fc531dbb1408c1f558019bff532b09a0106d02aca0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550445, "uuid": "143a0fa8-e580-4d7e-bd1a-d017ad998a20", "comment": "Malware payload (Heodo)", "value": "c42bbaacbb06339af7b25c378cba3e4f140037ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550445, "uuid": "014434e0-7de3-4505-a13d-df16aadbf288", "comment": "Malware payload (Heodo)", "value": "c9ed3b0710db92f576f221a62c5a252d735dc7aeaf2a13e41f4de805d0d970ab21e3f707d207092bf3e297cdfa888269", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550445, "uuid": "44271e70-3e83-4c92-88f7-5903e9d727bd", "value": "T176A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550445, "uuid": "5cef30ff-155f-477d-84ef-e5daf0bc97ca", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550445, "uuid": "9321f9ed-e275-46e6-89cb-9e918acef1ee", "value": "12288:vicw4w2Vb0zq6k5Z2mTFjqkGXNrGHORQuBT:viSwub0W6LmTTwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550445, "uuid": "679f8eec-be8d-4af5-b2cd-18471a1f615b", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550445, "uuid": "70853884-7368-4c32-ab5e-b810e14bc3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550445, "uuid": "25326e26-e6aa-4d85-a132-cd352418f3cd", "value": "u8JAgVy0n.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b990c5-9420-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645562769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562769, "uuid": "acdf4f53-9df0-420b-9aa4-df6f4a3d9692", "comment": "Malware payload (Mirai)", "value": "1aed69325c601ba3d000dec3a683b964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562769, "uuid": "1554a208-2778-467a-bb11-bfbb91640bf9", "comment": "Malware payload (Mirai)", "value": "3383e6c9b573c96d5e4fd58ce176ff9b6b2b8154717ae2950582cf0e488d0c29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562769, "uuid": "7c14c928-28d0-4fdf-b3a2-2ab6f7de5579", "comment": "Malware payload (Mirai)", "value": "69ef52a81b0c5411156cabbffdcbc1db2849e032", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562769, "uuid": "7bda917b-b894-4a21-9eb5-a8c1328c811c", "comment": "Malware payload (Mirai)", "value": "003e0ba81100f4455b9e7f5d2cd4ab4f7d10d693ffe37ef435943745bd2618e075b34def64c9261506fd2b125d74e432", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562769, "uuid": "59e62a38-93dc-457f-a258-0683a0a228f9", "value": "T159F2F1FD3B41EDF6C06AA5FA6BA117619AF54962BC127C1D2D00E4E0251B8EC3BC25D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562769, "uuid": "4af50ec3-860f-4bbe-8a4b-2ac4714a3a37", "value": "768:4DA8ZlUXk+GZ1hYYRR8OONx8qgVeUas0a3oE5WbYKinNN8bAKcI89SJgGlzDpbuR:QeX5c1BRR8OOIqKeU90RlELgbAIFVJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562769, "uuid": "92414b80-1655-49a0-9335-f27b90968e04", "value": 36912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562769, "uuid": "c72a0df5-180a-4b0f-94f1-c49fd666179a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562769, "uuid": "614f419a-1fc9-4ed7-a536-0eb1cb69b34f", "value": "1aed69325c601ba3d000dec3a683b964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad85261e-939b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645505738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505738, "uuid": "facb4e3e-1c9f-4fe5-b05a-10ec7663f38c", "comment": "Malware payload", "value": "1dff73ac05f8be33adfbffa0cc201368", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505738, "uuid": "e126f70c-9f3d-4cb5-a681-87b25d26f71a", "comment": "Malware payload", "value": "3433ab5ef474a7731205a298fb9a9e6a9c4c2f9aac27e8061dd1ce3f081069f7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505738, "uuid": "55d78b19-275d-4afa-b075-98d43a348b91", "comment": "Malware payload", "value": "0380d253fade986bdded22015559fc5de9726063", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505738, "uuid": "804a4786-b497-4d22-8c34-09d6eb8fc9d5", "comment": "Malware payload", "value": "76fdcc322b82b4c94a9e6db7058df01b25368e7334c064bd6a0ef0a5e8ac6cade3aa48ebbd9641d198cedeeeadd62e88", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505738, "uuid": "1321f61c-af15-4ab1-be3b-0970905f2c97", "value": "T19A51E062280E0E8330475DF2436A9A91FB02C4AB2A9D73F951D5431FF795E053A9F1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505738, "uuid": "b802d822-83a4-4233-964e-fd7b8788f092", "value": "48:CPCnsIYeCAujHjXFIBwB+aIIO4fOaT6t5O:pnsFVIP7naT6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505738, "uuid": "f248394b-b09d-4574-87c0-bf783da46f1b", "value": 3043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505738, "uuid": "fcd6fbee-7d2d-4696-ab8b-6033791d75d1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505738, "uuid": "558de591-1ba4-40ba-94b7-4def0155727d", "value": "coin.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7834ae6c-93bd-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645520251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520251, "uuid": "5e62f350-beb2-44e0-be5d-50f4eff4332a", "comment": "Malware payload (AsyncRAT)", "value": "3c39836dedf6779a0207819c72238fa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520251, "uuid": "200b68bf-bbf5-41cb-8343-ee92533697ea", "comment": "Malware payload (AsyncRAT)", "value": "34694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520251, "uuid": "c73766eb-775d-4ea6-922f-1aa41e7092d1", "comment": "Malware payload (AsyncRAT)", "value": "07433edf63057fff1e96ddbf5249aa2c50f69dbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520251, "uuid": "5663f940-f0be-491c-bc2f-62bec63c3ff2", "comment": "Malware payload (AsyncRAT)", "value": "60044473294ccd6d07cb2b872ea98366f9af0ef985d958ccdf2aa961161447d5e4824bbd776f80408a43ff8021833ee6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520251, "uuid": "a6f6cf3d-beab-4ed1-9340-9ba97fc9cef1", "value": "T1E1E47C08E7424AC0ECD9067A85F62B252751FDB58DDB8A07B1AC347EC9BB3757E8064C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520251, "uuid": "4534b34e-725d-45db-9b37-e8c0877c839e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520251, "uuid": "c2b002ad-3b21-4275-9a2e-0d288d2bf017", "value": "12288:Nuw7yDzOyH22qla5w/yXbxbY17WmjuUBfI5Gr5Y2uC8qVLupbzSWq8qatDej3+A/:Nb70zPH0MW/IbxbYC8I5Gr5Y2uC8qVLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645520251, "uuid": "7a6d7d8e-4f66-4303-9c10-50aa96910a49", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645520251, "uuid": "bd3960bc-148a-42c0-a2be-e3a63e10295d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520251, "uuid": "2605571b-4b15-4790-891b-a71462732bdd", "value": "3c39836dedf6779a0207819c72238fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3d0892-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492097, "uuid": "ff11a8f2-3ba0-4fea-ad4c-7dc60c1a01b3", "comment": "Malware payload (Mirai)", "value": "4c34cb669745d8fabf5c1f0c1ab640ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492097, "uuid": "934683bc-f8e2-47de-b9d5-74e472bdd624", "comment": "Malware payload (Mirai)", "value": "34e8bec0c44d2ef8131d96df4b9a16192d5b872dc6a805da942305442a163a9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492097, "uuid": "215bb1a7-3922-4736-a8bb-23b8609525cb", "comment": "Malware payload (Mirai)", "value": "fc0e140d128b680c3f41415a93c5c57af11ef09b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492097, "uuid": "d0594f4b-4de8-485c-a209-9714bdc926be", "comment": "Malware payload (Mirai)", "value": "6c638a5072ead0d4f7ddcceb0f61b7b1f68d2563dd4394be616864347cb1b2530bf1e8f77297ca3d89c59eca4e9dec23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492097, "uuid": "aea0e76d-7780-4b05-97c9-fa65e6045623", "value": "T111E2E060E0EE9AB0E7FBE9F9895784C9734709DBA495C6E113C59E006E2033E6D42CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492097, "uuid": "39c53fd3-725b-4a8e-88ae-62d2e520e144", "value": "768:munLbE9dxsmJBGZ+QGQrlPelUZFqcLBOeF6Aa51rzCp9w+h24uVcqgw0RNWXEl:Bk9zRJ+HlPyErL4eo51rkVh24u+qgw0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492097, "uuid": "acf705a9-359a-4125-bb11-77da4ecf222a", "value": 32936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492097, "uuid": "aa6bae95-8f09-4a3d-b1d3-3299e3aef19e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492097, "uuid": "a3570b85-3c48-4c8d-84b7-40b153196f6f", "value": "4c34cb669745d8fabf5c1f0c1ab640ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1b7f1a-9374-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488775, "uuid": "e3b8f3b8-c006-46ec-b455-a9837f3f881e", "comment": "Malware payload (Mirai)", "value": "2e4e9bed955085ff52bacf1c8a6b3c8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488775, "uuid": "9cb4273b-31bf-40ad-aa39-4ae3aa52f57e", "comment": "Malware payload (Mirai)", "value": "35413d4f2ea1e8b62affb58803b82dfa36bafba2f027281787b337dd2552f7fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488775, "uuid": "a4efdf84-0ed7-4704-90d8-9b7d787f7fb5", "comment": "Malware payload (Mirai)", "value": "18a138aede8b478eb34d2150c1f2f7b9266b6967", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488775, "uuid": "405e8ffa-04cc-42b3-af5f-553551fa950c", "comment": "Malware payload (Mirai)", "value": "70d4dac541d7e414c6f6e4f342a9434960255d7fa0ab278d7dc2ab8379c3d523b6c275caa9d3a04a2ec0bd10ccbe208c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488775, "uuid": "531af2ad-4b1e-4da2-a237-42af69bba570", "value": "T1E0833B97B800DDBDFC1AE67A40130A0DFA30A2645F530F37665BFDA3BC721A85956E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488775, "uuid": "24e4ff8b-1fb8-4d4b-90be-3db4b5c8322c", "value": "1536:hBxw63m+Jd+Ahxx8Jn6lOJhCQPK1DDTRWX+6:h5JdLhxwJYQPaa+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488775, "uuid": "b39f13dd-e562-4f56-8bb8-c342115167ec", "value": 83916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488775, "uuid": "da215605-8b73-4b93-8151-aef32ba786ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488775, "uuid": "37bcb245-a70f-4b58-917e-372880f17bd2", "value": "2e4e9bed955085ff52bacf1c8a6b3c8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5811fb3-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518314, "uuid": "5d80fab8-a024-409a-ba91-c40fa54bda8e", "comment": "Malware payload (njrat)", "value": "353b620decd29e38160ed238d6b5f35f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518314, "uuid": "fa992dbd-347b-4384-b0af-f20030f81968", "comment": "Malware payload (njrat)", "value": "354c30cb37b2eadcee7192e7122ac0c5fce3bec24bd38023b5f89d9f0f0021e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518314, "uuid": "fc33af70-ce21-4f67-92cd-81a35f940189", "comment": "Malware payload (njrat)", "value": "e334d22426eac5aac6518bf5d6caef3e21168086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518314, "uuid": "10a4a8dc-03af-440f-9ee1-2e6c99af1f94", "comment": "Malware payload (njrat)", "value": "d3fd10020d2637541b324683e59c0e67da3267a2ceab132b7de1d8956b3b6a6debe6eb9b38a48fe14fc7fc2d4b5b69e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518314, "uuid": "199ffb5f-1784-4f96-b813-f12b4dd3ae4d", "value": "T14CF35B9A778A4B15E67C0C74D0FB993403F19AC32532E7C92FC8269D8A122D35E4D7E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518314, "uuid": "21bf7256-cdf3-404e-ab5a-d93fe965f992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518314, "uuid": "efbc6c69-fc25-47ba-9115-15d6ffa3a545", "value": "3072:vYVZ/1fv1zIhYx/AkFOYQqmEyPs4bgCVAB+cgo:vYhZE41wRb+Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518314, "uuid": "edf5da2b-a33c-453f-899f-5f45ebdcd81e", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518314, "uuid": "8180c4e7-2c71-4c9a-b567-fc86938d61ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518314, "uuid": "1c32bb58-271e-4e49-89cf-1624ab31c72a", "value": "353b620decd29e38160ed238d6b5f35f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace90c71-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645513897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513897, "uuid": "7dd05467-4648-41a4-97bc-d443cdc1f0ce", "comment": "Malware payload (SnakeKeylogger)", "value": "3ddc9a0f7ad0ce55ce80ec41fd02c333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513897, "uuid": "1531d0ad-57bd-405f-ac41-189af418ceb5", "comment": "Malware payload (SnakeKeylogger)", "value": "35975f34651bd1920c18f40581ab0f256348331b5f5e5c2c8ce7ec2364aa5195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513897, "uuid": "598b8049-4a57-4534-b159-1dcf5b46770d", "comment": "Malware payload (SnakeKeylogger)", "value": "453bdc445c250f5e1b7ec8830efb0fda22319de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513897, "uuid": "553cd5a4-23ee-4e51-ab7b-02040f093de2", "comment": "Malware payload (SnakeKeylogger)", "value": "7377ee1c3f5ccc460f9cf5815ef560e2e0b679acb5b4832246ab23ec05637f705fc48a661e81db9792b307936f015a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513897, "uuid": "844426e9-588a-4578-b9b6-fe03b7cc4477", "value": "T187E44AD403543EABC5FD30B863041C81BAFAEA522612DF8E3DE174E6D6C2A46972775C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513897, "uuid": "ad318339-24c7-41fc-8c84-4847b23957f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513897, "uuid": "84a165de-e773-45e2-8892-2bcd4fcfa8c2", "value": "12288:W5gdGF1DXt5O6Ji+i7r8YCFNxDw0wJsJM2gyYFWbbeaBK+p+u6Y:UTXfvJa7TmNVw0+EYzaBV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513897, "uuid": "3a10e7d5-c377-4536-afc6-4a36dd288f15", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513897, "uuid": "1e7f4a4b-046e-4367-b162-716ab7431495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513897, "uuid": "897a6e36-7f34-4f52-9be1-9603c9a0ce09", "value": "1mGgDKrKmz9iE2T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a22104b-9403-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645550212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550212, "uuid": "a5620714-b2c3-4fd9-a94a-a81d7d19dd68", "comment": "Malware payload", "value": "feb9fdc7a23e5b7a353d79222a62c026", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550212, "uuid": "c694033d-7e17-4610-98b2-3df2d8cda61d", "comment": "Malware payload", "value": "36c609304eedcc0449e569c57f238cc9a8215e5b4a9ed40bfbce9dc27ec9653f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550212, "uuid": "1da41aa1-cd0d-45dc-9abd-254968097bcf", "comment": "Malware payload", "value": "8165110f7b5d464ad1ff4b247b3b2f524bfde59b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550212, "uuid": "00974deb-e1e9-42e4-9175-73e806df02f5", "comment": "Malware payload", "value": "a22c1798da1310496e93437dbf234abf1551632985ab31c7b2a08faeca21bf49e3dcccff23b18fbfdf77ca95e390255a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550212, "uuid": "e8f6c4d7-0c49-40c9-bea5-28bc541051eb", "value": "T1B3930769B681C95BCA5807344CD7CBF67227BC424E7A87473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550212, "uuid": "d757cab7-7d35-4902-96b2-66a441bb36e9", "value": "1536:5yehv7q2Pjx45uoDGTj+5xtekEvi8/dg98EsAeE9jbDXQ4YokWvgrPE4nWHPNc2a:5yehv7q2Pjx45uoDGTj+5xtekEvi8/d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550212, "uuid": "4638ab95-fbfb-4c4e-a63b-088de64550d2", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550212, "uuid": "c314094b-74c9-4a24-b005-2de6bb930832", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550212, "uuid": "99d4b656-3ba3-45ff-9c1b-cef280157dca", "value": "tmp38eqld8m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb34183-9406-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645551454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551454, "uuid": "98b2d8a2-5fd9-47f9-a271-2eaf4cd951eb", "comment": "Malware payload (Heodo)", "value": "78c2dd6b415e813d7c4d1101ec068a9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551454, "uuid": "0206b106-bc24-4f73-84b0-798be68f0830", "comment": "Malware payload (Heodo)", "value": "36de7baea0c5ac9032d36b86767427064931e061fb81e9f8a31c59a2a5407546", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551454, "uuid": "471ca115-62a1-4910-8f82-6a9f5035928d", "comment": "Malware payload (Heodo)", "value": "de59b479a1a2de0fdee59de1ed006639bd27e835", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551454, "uuid": "e5d982c8-cf03-4e8c-ac84-d48d3eb99d73", "comment": "Malware payload (Heodo)", "value": "bed92aba296f3ee6382930886ce73de498d4fbf0cc532b30cdfb67db797c6336e16a73b7f9f2d6ef1cfdb8b4cbc35e31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551454, "uuid": "8ef1a09e-ddb3-45f8-8509-4730cdc0222b", "value": "T1DEA4AE21B6D0D432C26E30747A16E2B15AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551454, "uuid": "9857742d-f89c-4951-81aa-5b545dbaf7f0", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551454, "uuid": "99d6c212-f512-4f03-9960-2b2d9c3adac5", "value": "12288:vicw4w2Vb0zq6k5Z2mTsjqkGXNrGHORQuBT:viSwub0W6LmT8wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551454, "uuid": "11f6bf5e-b41a-45c4-9910-d6c2b439ac48", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551454, "uuid": "4b175c09-a880-4d33-888d-a66a635de2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551454, "uuid": "6449d7a9-9764-41e4-8e04-713ae696b85c", "value": "78c2dd6b415e813d7c4d1101ec068a9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13de09e-9418-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645559512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559512, "uuid": "128a9c79-c487-4f3e-b0da-bf75b556c706", "comment": "Malware payload", "value": "f91984d0f12b481c8cc53059cbb86f02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559512, "uuid": "8d415e73-6a7c-46a1-bcfc-128dfc6718c5", "comment": "Malware payload", "value": "36e08c2df39cd84d8969a95de6a6882fbc954e7ca31a5a5d4be8ec33cfa84649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559512, "uuid": "217b13f5-78ba-4149-a62c-3874864b5346", "comment": "Malware payload", "value": "fab803559e83e053c455145da709e965518b4ca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559512, "uuid": "557e5b41-045f-43e8-b465-30962a83a6e1", "comment": "Malware payload", "value": "363c6430951f6a108cb9ee2ca0b0865f989f35fbf4d6704a79b6900310a0246dc8d9343be811a24ec918ab9cb777da72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559512, "uuid": "997c0c8d-b576-4dab-a752-604c09118a3d", "value": "T1DEF48D1A73A501FCE0BBD03A89529A52FB727C1607618BDF13A0075B2F676E45E3E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559512, "uuid": "7cf031de-a13e-4ee6-8463-0801f3d75d74", "value": "26a85e9be51624486be42c0ab7b10bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559512, "uuid": "97c739d3-4283-492f-a961-285a166792ce", "value": "12288:FlR8myccdcCmbGxzYe+5F2QUzXWYgeWYg955/155/h0uXuDfvrXT42oXn6xkAx4w:dlyc3rbGx0z2QUz9uXuDfvrXT3ye9S4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559512, "uuid": "6e6b379a-e2e8-4074-9531-d33fad0027dc", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559512, "uuid": "43826260-d966-4dfb-8f02-74f42cf14512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559512, "uuid": "de0c778a-e656-4a83-8572-6d93c55d8f0c", "value": "cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8771640e-93c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1645523283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523283, "uuid": "7a33214e-e646-4c5f-ac37-35e52ab315b4", "comment": "Malware payload (Gozi)", "value": "80973714181535b9fb854929ee8e879c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523283, "uuid": "fc7fced0-7e7d-44b1-9975-fb31460b827b", "comment": "Malware payload (Gozi)", "value": "37603cddc36ec9c8b2b6c3d6a0d1a05ee33b1df81befe404ffcc398a6acd1edb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523283, "uuid": "8a40bbec-1819-4eed-a7c0-8f6ba52ef8d1", "comment": "Malware payload (Gozi)", "value": "a71ece59f3c0875476d2ccc12a2ce39e59ef1bb3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523283, "uuid": "4d11041b-225d-4c44-91bb-852a71fc6e95", "comment": "Malware payload (Gozi)", "value": "4c5437ef16a7fad2ceccd35e4eacbfdb58fa59b3b7e4f5656219fded57dc8967959b8d10cfc5f7387f4cc6d4a95ddbae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523283, "uuid": "cb978ded-77a9-4bbf-bdf7-ee2e3688960b", "value": "T15F65C49EB2D01ECCF1E638BC7A5463A90F8A5FB10E3E6072B003388A56715F95D25B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523283, "uuid": "6c251c7f-ef82-4fb8-ad89-c314b9ca599f", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523283, "uuid": "e46275ae-4ab0-4bc0-9545-fcb3119aee1c", "value": "24576:AMNsUX1VjnGO5RmnJoXlEuWRGt0R3SQ6c0Naa/Ek3vRtGEaL1M:ARWrGOiJoEuWRdSc0Naa/Ek/fGEoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645523283, "uuid": "8564d91b-f026-4cad-84e0-c29ae3e9cd12", "value": 1450496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645523283, "uuid": "10c0b69e-205a-4b0c-8a0b-d471cab5cc0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523283, "uuid": "6c534e85-3bbf-492c-811a-6c6524099297", "value": "status bmp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bb61da-93aa-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645512305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512305, "uuid": "0ec64e55-22e4-48e0-ba48-250b87036bfd", "comment": "Malware payload (AgentTesla)", "value": "38ed7feb2bd0596f931d8ff2eff4da9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512305, "uuid": "b2535625-5e24-4564-91de-5121ad207c1b", "comment": "Malware payload (AgentTesla)", "value": "378fac0bc619bce526cd485f68cc6241490f80e6ca350fbc7edf70a670f90328", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512305, "uuid": "e9e7370e-3331-4c12-ad72-c00433f79f76", "comment": "Malware payload (AgentTesla)", "value": "4064e37f6f8df5e947a4c1643fc9705fb74979b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512305, "uuid": "5bf3f080-2220-424f-822a-e31470198d54", "comment": "Malware payload (AgentTesla)", "value": "6653dbcb2ead988fe14f86ad48def03b309f600884218f9b514940cc879a7342b1e24769400c0234d8030d5c40eca6ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512305, "uuid": "b12dbaaf-7a2b-476c-a2b0-739c7654c82a", "value": "T1CB541286B6D14D73C86A0030249F93AA9F77EA6533412743AB9C76393E513C7D5362CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512305, "uuid": "ea01ee89-d422-46da-aae2-b68c46219616", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512305, "uuid": "dc1af6bd-aecf-44a9-8144-155a83d22689", "value": "6144:2xDysZ/buHekKSd649UgCI5rBZF2NZD0QMvEHNhHZ:/sZ/GQuUyNXKZD3DrHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645512305, "uuid": "cf761d45-593e-4c4a-b711-e1622ad084db", "value": 301767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645512305, "uuid": "bad7d36d-245c-4e59-b154-a75d639ba9ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512305, "uuid": "e4f2e11d-9ea6-4729-93f4-162b36f33fde", "value": "ArcelorMittal -RM679847650 RM634985744.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734c928c-93fb-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645546872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546872, "uuid": "28324c3b-226e-4773-ba01-b0c4d2d2b1c2", "comment": "Malware payload (njrat)", "value": "be4f6d277e120863b3c35aed3f2562f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546872, "uuid": "6d056fc0-500c-4ed0-a201-239b829ff384", "comment": "Malware payload (njrat)", "value": "38928ae157586ec7785121f79ac5f9eb6727eae66aa512d8adf52d9485928126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546872, "uuid": "2d2ed8a2-a86c-4400-9837-508f652f7fa7", "comment": "Malware payload (njrat)", "value": "1b02a29b0ebe097572497d9b1e22f9321de04843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546872, "uuid": "44a9bf63-b68c-450e-8a72-cb1742869551", "comment": "Malware payload (njrat)", "value": "5dd12dcb52c1a5108df1a1d85634aa46aea8876dd27ced4b97f94b8d587aff5bc1ff8d4c04516af7194ba072e20dcac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546872, "uuid": "1aab6bba-1011-42d8-8ba0-54c446c64a1c", "value": "T150B2194E3FB98856D5AC1B748AB5965003B491870423EE2FCCC550CBAFB36D92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546872, "uuid": "9fbebc22-754c-47d0-94f5-33d39718fc91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546872, "uuid": "6f82524a-1dcd-463b-980b-50e495c81bbc", "value": "384:y8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZls:lXcwt3tRpcnut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546872, "uuid": "ae705e60-7865-42cd-8eb9-13546868a2b9", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546872, "uuid": "b1222bac-3ad8-4a1e-9b92-b6651ca460b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546872, "uuid": "7f812ea4-2b11-4b05-a768-787d536683fa", "value": "be4f6d277e120863b3c35aed3f2562f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373cec66-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645513700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513700, "uuid": "8de50ff8-2dc9-46b5-844a-60ecd2b1115f", "comment": "Malware payload", "value": "ca7644bf44f3ffd3f9d55045ed118d36", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513700, "uuid": "049dec3d-3873-4c69-b97d-0c283134ec03", "comment": "Malware payload", "value": "38b21e8f91729305ce8177a6e1fefab0ced2f19f02e1f0ecc688ecd795dc13f5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513700, "uuid": "6a684a7e-c12e-420b-b159-8b905b2997ad", "comment": "Malware payload", "value": "785d80ccb983b2af5aaf16dbb282349037d4850a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513700, "uuid": "c8070ad1-1ea3-4bf8-bd5e-1380581e2ce6", "comment": "Malware payload", "value": "23a0aace4f3c29ebf80a96c5ac8630360e3c4aa8b27f1484ca6613399fb4626debfe5412315fb0ad0f9556b9e53795ab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513700, "uuid": "5c177724-1dd4-49d0-8968-504a335dd00b", "value": "T1C345120A31C38CC1CB59933514D6FA3E86D4BD85BDE29583B6FE3E0D73B59846A83219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513700, "uuid": "4d5a95de-de4a-4fc8-a906-33e76909a089", "value": "24576:6JLILVHyUt7yQaaPXHDldejhek7dZfNifbOR+cQlm80pL5:Ks5H5tZaaPHDl/kJvifbOUcQE8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513700, "uuid": "6d23d93d-1301-403a-9add-fedec56ecc5e", "value": 1231860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513700, "uuid": "e36eda02-4307-4995-90b9-e76dded8eefd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513700, "uuid": "cd0caa79-10a7-431b-905f-c8045ac47e72", "value": "2022 LBH Race Flier 2-21-22 Final.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b955a886-9413-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645557297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557297, "uuid": "6b69c27f-839f-4171-899c-46b739373080", "comment": "Malware payload", "value": "351f38e44b29dfe9d4e4d1dfb5f36729", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557297, "uuid": "226d069c-bcbe-44a8-b83d-b460a1d395ed", "comment": "Malware payload", "value": "38e2b574be0d3ab646af51015f73cc96a62a22b47ffeb41b6ec6aa8ee56bc793", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557297, "uuid": "babbea42-c56b-4594-9bea-ef68d7bdcc59", "comment": "Malware payload", "value": "7a2ddea6b5f08c41e6ce5b20422db3146870a377", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557297, "uuid": "6015b5a0-6c0a-4422-b5ee-bcf46da41933", "comment": "Malware payload", "value": "1032ff69fa434be447240b834e6e5173d58da7a8e0aee7e6e647da90929b1b4f5fcaf19f5539f89040631cc70f3e10eb", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557297, "uuid": "aeaa2e42-bb7c-4c35-b15f-093c3f00fb26", "value": "T1F505C46E19B67FC6054D3E285402380626C0954FD8E4952ADAC71BF387F4AD70F6B3EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557297, "uuid": "5f00c4a3-8ff6-40fc-9c90-d1ae6115a5c9", "value": "6144:zVJLS7GCL7sei2/y1TSA5jaFoK/fGAB9ZT0Bw3wQNjp0UWQe2do7Y7eNu:icko6RTU40L/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645557297, "uuid": "c6201a21-2448-4831-994a-6b2fc6c7be8f", "value": 843793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645557297, "uuid": "37f4c000-5aff-4460-809e-c297887da815", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557297, "uuid": "9d715475-e430-4e37-9b4e-7a287606ca0a", "value": "dhQ.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ccb0c2-942a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645567004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "cc19064e-9c5d-4a90-904a-5f63087c505b", "comment": "Malware payload (Heodo)", "value": "dc58838d1eba61cd26727ba05c780712", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "2832f2ac-ed0a-41cb-9d72-bbcedac98430", "comment": "Malware payload (Heodo)", "value": "390bacb4d2f7b1ea7dbcfe01b7b5db7a41770e97a8f3a9f063ea0fc1d1f40a1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "84459fb3-30ec-4391-8309-86173bdddbe3", "comment": "Malware payload (Heodo)", "value": "8a24f2aa094d67431733f94e23277ec286bbdbfa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "24b513cd-64d5-4e0b-ad6a-dd80a8c8d551", "comment": "Malware payload (Heodo)", "value": "d214d71869b4c7c1accda044ed0e363ec9e77ee050c7b3a99415ffe8d936abba96ab4391057d68005e02e5374b62c8e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "6fbfb8f2-10b8-4dbd-938a-51a5d58a3976", "value": "T175B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "f84eab27-394a-42cc-85e8-474e8d585b7a", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "e43fd91f-92cd-4310-9d4e-700711f5d17f", "value": "12288:IOzyEtBX2ZHq79+t6/G5YgvmgZDa6A9TU:lnmZKR+nYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645567004, "uuid": "d31c2fb8-683f-43cf-953e-5d9a63728bef", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645567004, "uuid": "d12485a8-e544-4c62-9f55-8c065c42788d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "fbda3ce9-0e6f-4e32-8a72-98f9136f2930", "value": "emotet_exe_e4_390bacb4d2f7b1ea7dbcfe01b7b5db7a41770e97a8f3a9f063ea0fc1d1f40a1f_2022-02-22__215638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f683dd-93d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531070, "uuid": "a2aba1e9-9993-403b-ab45-fd2aec9b4914", "comment": "Malware payload (Mirai)", "value": "5a16508c14910c2bf464926c4c4e8271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531070, "uuid": "8fc05317-9de2-42ba-b5bd-afc64099f3bf", "comment": "Malware payload (Mirai)", "value": "39322ad75a3f6b19854c864553a65972d858e74db40c177035501a773942d047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531070, "uuid": "161b53e5-4182-4fe0-91c8-69235facc235", "comment": "Malware payload (Mirai)", "value": "6997dc613bc642aed18af2b8d51e850384bc1804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531070, "uuid": "3c4fd730-7095-466a-acad-ffaac03a4abe", "comment": "Malware payload (Mirai)", "value": "07b2e27001ae5c86040e7484f1dc4eabe8ce7c3f71283bc291f06ca031591c71a66927e6bec7252f1f9043693251bcbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531070, "uuid": "8e9a812e-1cf4-435d-bf50-6131e46d29f5", "value": "T1AE43074AFD819F00D4D425BEFE5E024D33635BA8E3FE7102AE146B2527CA95B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531070, "uuid": "606d0f07-ba75-45d5-a166-651d8bbef44d", "value": "1536:6inedTlczcXQxTaSxxCLnG14Tb9lqnilRSi7jp:qdTlClT3xCLnG15IRSivp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531070, "uuid": "b6f375fd-001c-4583-98dd-b2cd99e121fb", "value": 59532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531070, "uuid": "d96786c0-803d-45e3-9ecd-615f50ed02ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531070, "uuid": "878c02c2-4a7f-44e1-ae50-421e9915fdf7", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19fcb44-93c3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645523032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523032, "uuid": "a6945f00-d7dd-444e-8837-68640d124c24", "comment": "Malware payload", "value": "ea43b8a65c325efc8d39299d3d1acff0", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523032, "uuid": "4ea4a341-e132-4881-ac2f-a6c63f8cabbc", "comment": "Malware payload", "value": "39b3cdbdcb372a5b333080ae568a368f73db99cd139830dd95cb715e77b72ca5", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523032, "uuid": "43a4cec7-6ae5-4ac5-882b-ad4969cae137", "comment": "Malware payload", "value": "a21c39e07f26ed8ea888bfb685e6f2c16da39a8a", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523032, "uuid": "10ad7a30-99e8-4a82-82c5-2d90df2de497", "comment": "Malware payload", "value": "f7f749e190593e4db510381d9b2b953a8947ad8f1d24bcfc1876b8ba37c0b4056ed441df5c5f14c64214fc0dee9c578a", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523032, "uuid": "e99fb5dc-3bce-417f-a3f7-d808c2db1018", "value": "T146D02B259D30E4CC434EB0A1CA95261C25D241208F350BA8C5150456D91CBC8D71908C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523032, "uuid": "8b2d421f-437d-46fb-a034-876953e16017", "value": "6:hKX9tSa2jkzozaqEHiO6snaYpXkGVokOMkCv/RSVxWpCY:hKNtSjJ2qEHiqnaYuGPOsn+bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645523032, "uuid": "bce00d5c-7cc0-4613-8c63-be41d681e481", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645523032, "uuid": "5ad1fc1c-3271-4eed-b873-dad66d9edea7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523032, "uuid": "ba9ba67e-754e-4f5f-8ede-a71d09384a49", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866548bf-9427-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565802, "uuid": "62c53191-f2db-4c96-834a-ad036ebb07c5", "comment": "Malware payload (Heodo)", "value": "2a20a7188b1f6fa1a16fe742a63cb668", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565802, "uuid": "da9845b7-504d-4e69-ae07-2d759870cf05", "comment": "Malware payload (Heodo)", "value": "3a05d2d30fd3489977315d014a8c93e6b1eeeacdb7c6d67e9f54e8abd22eece9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565802, "uuid": "56c2c901-d6cd-420d-9364-e65200a6c7a1", "comment": "Malware payload (Heodo)", "value": "80c3b83c3689f9d9a3ebaeccb78d876930bdeac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565802, "uuid": "301ad634-9809-4237-bc30-73e7390759c0", "comment": "Malware payload (Heodo)", "value": "1959b7e032d8166ccc67aa78bf9f1899d45e11a58764f844839fd8cf56ae918963d4a6baabfa2d3f70c6a80e243cc802", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565802, "uuid": "58648e33-f66a-40f0-aa4a-c6ed0fe1bd84", "value": "T13AB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565802, "uuid": "e66e99bf-a0ce-45ec-a8b2-ac6979005519", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565802, "uuid": "678d8673-fc46-4194-89e0-d6e5d819ae1e", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wlIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWSzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565802, "uuid": "6700a986-6d7f-49ec-b00e-99112bdff615", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565802, "uuid": "c5f445e5-69cb-47c7-886e-259d3127ab6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565802, "uuid": "a38078b7-46f4-49da-b34b-9ec43e685ce7", "value": "2a20a7188b1f6fa1a16fe742a63cb668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a9cfd8-93c9-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645525560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645525560, "uuid": "57a230c2-f613-4a24-a077-53a35c11e6c8", "comment": "Malware payload (GuLoader)", "value": "f95a0fd030e4ce77457249b6a9e0587c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645525560, "uuid": "b02dd6e4-a558-4cb8-9364-c5b310dfc456", "comment": "Malware payload (GuLoader)", "value": "3b421d57a086755d0e504144c87fe9639c64dfb3d803172ef539b54f62ca155e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645525560, "uuid": "5a956835-957e-40fd-8baa-f073d3a5f8e9", "comment": "Malware payload (GuLoader)", "value": "8a9953e73fdd843e5a757e95300f4b9cf32f1118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645525560, "uuid": "7ce2c552-d177-4080-9c13-55da14c5f3aa", "comment": "Malware payload (GuLoader)", "value": "50e14ff3fbb64b4de44313fd00358b80c0c3ae87a2e2382f603339e84bde2fb5220f4884aea6a9d39a9bf0406db60cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645525560, "uuid": "c88827d6-9904-4e4f-a78c-a59b81712254", "value": "T1B9D41256113182DFE2E202361865175BA6E4AF622332A5CF63507EBDFF39F819F25312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645525560, "uuid": "f4f7f887-62b7-4430-86e7-6cd2c5ad7084", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645525560, "uuid": "09bf07d0-ef40-4638-b07c-9f4a5ed948b9", "value": "12288:4b6UG1NAN8Axjam22QMPnJjUis5CUMq2PZgue0yzgX3GXefio:4bm1YfV2vhkUgPZgpgXWXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645525560, "uuid": "95842f94-53d1-4a2e-bfa6-cfb8fbc67014", "value": 623720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645525560, "uuid": "1a00b035-66f4-4f9c-a7d9-8393d9c08c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645525560, "uuid": "c53845b7-7e87-471c-a453-575af30ba805", "value": "Liquidacin por Factorizacin de Crditos.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c29553a-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1645514084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514084, "uuid": "9d0b8150-cbcb-4db7-b81f-7988883f81eb", "comment": "Malware payload (QuasarRAT)", "value": "2d8dab506e17c4f1f1b4e1a017b336cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514084, "uuid": "9f11a05e-5254-4fb4-aa45-02c259b0137d", "comment": "Malware payload (QuasarRAT)", "value": "3b507b09d27e783695ec84b5a6a14042043e4f5fb99462e6d5bb04ac9811ea38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514084, "uuid": "9a965835-5494-4028-b8d1-d4f6cc2372a9", "comment": "Malware payload (QuasarRAT)", "value": "a2e71f582b454ce5bfb370bb201d5cd529d6bfde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514084, "uuid": "f02e441a-de08-453b-9857-0539c8f19fac", "comment": "Malware payload (QuasarRAT)", "value": "4f5042ee52397cb1190f1325cc03aefa64b54b1b2efe6f3d31a5ae2110f8b7c7170c1cecc2c9e7b2d182b448a00a4220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514084, "uuid": "24528011-1fb1-49c2-8b3f-8cc8e5e64566", "value": "T15FD567DCC2DE5BC9B94010E43E4FF2F281AA0FBA149781F8774B82295D3C6B1B175966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514084, "uuid": "f3a341b7-ef0d-4fa3-993b-f157492e4909", "value": "bc47ee1cfeae875e3ba469dc385d9490", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514084, "uuid": "42d6b03e-b559-40df-bfcb-d58af7faff33", "value": "24576:nqdJFSi/GFzLco6crGlfPRilx4nFdzq7wYId9TbdPUak5t:nQ0AEulw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514084, "uuid": "8c1c2aa6-c995-4d74-aa4f-4f460e59b021", "value": 2978816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514084, "uuid": "4603a368-eae0-465f-8b0d-7cc1e89ad6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514084, "uuid": "3092444c-e4c8-4ef9-abb9-6a36de493b06", "value": "2d8dab506e17c4f1f1b4e1a017b336cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f741d54-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503969, "uuid": "05fdb8a4-2471-4291-b1a9-1981f1b241b2", "comment": "Malware payload (Mirai)", "value": "f4f98ac22130ac807c9b68aab0786984", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503969, "uuid": "71ed0d90-b576-4a0d-bb00-09b3794c4963", "comment": "Malware payload (Mirai)", "value": "3b8c82c44bf2320813d3610de78e6e54748929dc16c8ddb6cad92018bb278499", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503969, "uuid": "fc9fead3-cb56-460a-8c1e-83c3de7ef9a1", "comment": "Malware payload (Mirai)", "value": "6489f4791883275d298780f20392c7d62e23fc7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503969, "uuid": "625072e5-65b8-41c4-8455-e7a30c527f0c", "comment": "Malware payload (Mirai)", "value": "3a5d20712535b811e93310b46a175629d2173b6d4712698dc3aca48c69057ca5d8eefdd9b8511e7f654121a9d16b78e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503969, "uuid": "1bcd0e7d-fc6c-4696-89d0-e231f4a0adfa", "value": "T16A13F1347109F575C12EB237E0B3CD42B772F3FC42A6B562313A0C9C9653A18D4AA95E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503969, "uuid": "b5b827fb-6d2f-4e64-a574-6f27996ba08d", "value": "768:PVDqr1IJKlI1/xohCZhm+jJUqqDy2LI8k5mEPORBCMsPLNc7GPLs3UozUi:9Dqm3ZQxLnPEWyMaNY/zUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503969, "uuid": "470c5e0f-2e95-4e5c-82a0-ccc45be38d87", "value": 43476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503969, "uuid": "56d8b39c-9d2f-467f-baf9-ed9f1c87a46b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503969, "uuid": "8d7cf627-61ee-45de-a565-aef195ec171e", "value": "f4f98ac22130ac807c9b68aab0786984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69788cce-939f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645507342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507342, "uuid": "1f790487-1782-4a1f-8f6b-6e9567294c0b", "comment": "Malware payload (Formbook)", "value": "0bd78eb73748333d5a41930de799be58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507342, "uuid": "124d4286-2ca3-41f7-b54f-e2eb4b69d240", "comment": "Malware payload (Formbook)", "value": "3c010d88a118ba3cc666e05c6f8f82159ac38e5486b5ed60c65d870287b8cff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507342, "uuid": "c2c696ed-0a16-4aa2-aabb-20f2964c3265", "comment": "Malware payload (Formbook)", "value": "06db999f59b7da1413ed3a5a2ea6b059d5e0b013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507342, "uuid": "d58b3a57-fb5a-4dc2-ab7e-6e721ff20119", "comment": "Malware payload (Formbook)", "value": "4ac51920f9ce589edff7529e586ece3d5fb1d350daf2c2dfcc4727d9cca1f18295ad4c2df69ae403fa27ba679d2647c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507342, "uuid": "ee6925a3-0f35-4ddd-8547-0ae05919c77c", "value": "T13115CF142AAB1F3DF1B94BB648C0EC64F7A9F7232D09F37D78416586CA52B418D422B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507342, "uuid": "4ff4014d-a86d-4e3b-8ded-876a660cf89b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507342, "uuid": "efacc143-1c6a-477e-9f68-eaff6bf5b772", "value": "12288:vgB6v+WlNDh7jwf2+hyvKxKtXDSuuzwtoAyDMexREy2bNiNg0p:D+WlNyyyESuCSoAeZxirbIK0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645507342, "uuid": "df9df57e-64c3-4601-8f1e-0bcc758b0eab", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645507342, "uuid": "80d5a53b-9a01-431c-968b-a0ab0ac9e352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507342, "uuid": "d4ab3ac6-9108-4c42-9412-c904537bbcad", "value": "Scan_0000005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b993c7f-9385-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackCat)", "timestamp": 1645496205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496205, "uuid": "683aa11c-3dd2-49ef-bcf6-ebd4eee06818", "comment": "Malware payload (BlackCat)", "value": "5178bd507c07bc2d5274e0947834e48e", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496205, "uuid": "67a25bf3-5bdd-4118-a365-18a089e655b9", "comment": "Malware payload (BlackCat)", "value": "3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496205, "uuid": "9eb6de7f-afb7-484f-a88b-7d0caa41c337", "comment": "Malware payload (BlackCat)", "value": "dd69b20eb1931487d8b65060f2be3671bd5baf33", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496205, "uuid": "38d035d0-82f4-44ef-a8f1-99e9f1dff494", "comment": "Malware payload (BlackCat)", "value": "aea8f4b72c8c12a8d35cb63e81dc2a6a694d2afad968a48041ece66b22c4e617d54f79bc3230f55f69c28243d5ddebf1", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496205, "uuid": "bfa2c269-68c0-433f-b153-e0e83c25b559", "value": "T158E58E47F98356A9CDA71A70305EF33AA6314818452D8EA3E7F8DD207B2E7105EC9E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496205, "uuid": "420a4bf5-4db8-4b2e-b152-67c34bc3a200", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496205, "uuid": "098e5d98-080d-4afb-b041-276faf2b02f8", "value": "49152:HFyDutqkpj1TFUoXhjEjHjTu5tCeOZobIMfutoqKNi/RgaJ2weF:HFyDkNLXVEbjTuieOaR2+6vwweF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645496205, "uuid": "924d6477-1eca-4812-8cda-e6d263b65212", "value": 3081216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645496205, "uuid": "8cbe4bc2-5e04-4093-9b46-06ff513ed4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496205, "uuid": "b1909e59-7c58-415b-9dcb-fdaccb76ab0f", "value": "3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7f4450-9418-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645559534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559534, "uuid": "6ee4fb2c-b8af-442d-b057-c00485a074f1", "comment": "Malware payload", "value": "0c4c92fe8cb4a8106b5944a9b0964a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559534, "uuid": "a38adb94-c53e-4b21-b025-29f4934b6d59", "comment": "Malware payload", "value": "3d17fd9e7b6f5a98901cf7db19b26b997a5062e5aacfef9b312f8971584098a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559534, "uuid": "696e549f-5209-48e7-bf43-e78ffbf2304d", "comment": "Malware payload", "value": "5b656ec07f4b557feca9c428c23f3825934eca9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559534, "uuid": "6673e278-5a44-49fb-8e99-22965ac51ebd", "comment": "Malware payload", "value": "e07e682478ce7401a2470e98dd5a75f005feb73e5d206164d10f3c2d098309885b3b874ae1811fdbe6fdb4c432c3b660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559534, "uuid": "fc815d90-9102-45af-be52-bec25fa41b00", "value": "T1CBB24D416BFC5373E9EE0BB55C7292020172F6855222EA4F5CC8514B2F53FA88A637B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559534, "uuid": "9c1426d0-5657-476b-9bf8-38885fdeccbe", "value": "768:vNI6BN32W4Hf31eeaL2Jm8XQCwuGADIamEs4XYtqC/oRK:xBv8nX6z/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559534, "uuid": "f5648ea7-ab7a-47b4-8b26-b581efab8e6f", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559534, "uuid": "1612cc57-6cb4-4786-8d16-b5c29692bc3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559534, "uuid": "a57cce4a-cace-49b3-bafe-07bf5d6251ca", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b14793-940d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554550, "uuid": "6edf7f41-e791-4237-8288-0199631f2ce7", "comment": "Malware payload", "value": "f5c9f9e125f09e4f59f998257a222a48", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554550, "uuid": "d9eb95a5-d5cd-4438-8975-9490b1efa1fb", "comment": "Malware payload", "value": "3e22a1f3e226579efe169dafe2ff51ca922fb9b8062f999b1400cf75755751cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554550, "uuid": "a66a0d77-f815-4aae-949b-6631ee672785", "comment": "Malware payload", "value": "e7fde585c73bf264a7794a61cbfb01063dfa97fa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554550, "uuid": "2ed996b3-3ff4-4e60-b204-c298c5d58c11", "comment": "Malware payload", "value": "cd60deac5b2fdde1a2571c9e72fad16b348b4375b0475487ff8f87414128447d290305e81b321906afb0651923d3c8cc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554550, "uuid": "52c12b7a-634b-4b32-bcfe-d0701b3dabd6", "value": "T18F930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554550, "uuid": "4a6fc3bb-6440-4d7d-a8cd-865c05613a21", "value": "1536:Syehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGukWvgrPE4nWHPNc2A5:Syehv7q2Pjx45uoDGTj+5xtekEvi8/dM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554550, "uuid": "b10fca26-fc31-4b9d-a557-cd0a36944526", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554550, "uuid": "dd74862a-06fe-4cf5-ba5c-62a40d0628e4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554550, "uuid": "ff26a3c5-43a8-423a-9899-8ab14b2f3517", "value": "tmp72kek8lu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45435fb-9399-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645504998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504998, "uuid": "ebe9b379-b2d0-427f-8631-8bb3f10a0a4e", "comment": "Malware payload", "value": "beb6781a2716a7353acad307e1bb980a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504998, "uuid": "49e04191-be6c-4867-8115-82da090b4608", "comment": "Malware payload", "value": "3ee2d67ef34c132fb9f489062d29184be5b2e3d374d1840dd5adefdc3c49d1e9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504998, "uuid": "6d6e4c1e-e659-47a5-ab3f-7bbe38568951", "comment": "Malware payload", "value": "f0454f2627ea63dcaf6dca5d019ba78c9349979e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504998, "uuid": "6eb35c97-b932-4a33-a790-6f3b27ef7c30", "comment": "Malware payload", "value": "4d48e74b4d087a0afb5d5917aafe4644f9b836965f39115ca256b93ad7728c344e9f9b3e738efb07420d66bab2cc7ae6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504998, "uuid": "748b55b6-4918-4c17-a2f9-6f82aefa68f7", "value": "T1890148121ED06AB26F387EEBE71E2908E4DB61BD5E03090C47ED9460E81E9496423B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504998, "uuid": "b55c6ace-9246-47ee-b444-a23547a90174", "value": "24:y0UYG8wk8GvKIOv788w8WIoJW4dRA7oVqA/j4Rz:3f5wfGl8jpGq9i4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645504998, "uuid": "e270212a-e368-47cd-95ca-2a46d1b1bbca", "value": 849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645504998, "uuid": "190bf010-a2e1-4ca1-984f-6bc372b6378b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504998, "uuid": "307d88c2-cd4a-432c-b4c2-cd6acb22e1f5", "value": "orig.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8621f25-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518292, "uuid": "b8a55dc4-92c6-4f3a-b0c9-3ab7ca9202f6", "comment": "Malware payload (njrat)", "value": "28d853c82334bc0ec20de8247b79f1c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518292, "uuid": "6422dde3-ad7c-4e10-a59f-5dfe62a73539", "comment": "Malware payload (njrat)", "value": "406599fd47a6766a1dbeffac505e53d0b2e257f563e233413fd45d22e292826d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518292, "uuid": "2b950ce7-de73-4f96-b15c-86b3328ba878", "comment": "Malware payload (njrat)", "value": "759b3d3fb23cc10e4787a25d90769a09c33e05fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518292, "uuid": "7563a115-1bb4-498f-9d7a-1e9508b6ac0a", "comment": "Malware payload (njrat)", "value": "01d644a1b573ed90a40fceb34844bda4078e5b1d4210164209006dbcc0251880234bbaf1dc6ddc081b29c43184a57ac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518292, "uuid": "8428f498-e277-441f-95d5-827d847cedf9", "value": "T17D033A4D7FE181B8C4FD067B05B2D41207BAE04B6E23DD0E8EE564AA37636C58B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518292, "uuid": "5dcbd81c-91e6-41de-a1f5-57d76333da58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518292, "uuid": "68a446dd-05dc-4dae-aa90-8ae8d3dfb433", "value": "384:RrgYIiejrCVLO309QmykrtyCNEKZf8v+W+2rAF+rMRTyN/0L+EcoinblneHQM3ee:RBdGdkrM8F8GWdrM+rMRa8NuzMVHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518292, "uuid": "a91acb79-b2ec-448f-bc31-33a13bb47ec1", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518292, "uuid": "7d05ab8c-f3da-4739-a278-7de392369fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518292, "uuid": "6dcca417-c0b2-4329-b3fe-b8e91df1519c", "value": "28d853c82334bc0ec20de8247b79f1c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93479917-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503976, "uuid": "819ac2ce-0581-4d30-a198-744dfa19f041", "comment": "Malware payload (Mirai)", "value": "2ef219ea4bb265045b0f2174d38f1a70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503976, "uuid": "65069d17-9c98-47ca-90d7-e90f0d0aa502", "comment": "Malware payload (Mirai)", "value": "40e95460a8864ae5e028d300b411d8011224737ab7adf35b056cb692212ed62b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503976, "uuid": "9b417bf8-3344-40d6-a00e-b3c7b5db4455", "comment": "Malware payload (Mirai)", "value": "ae3949bf9340920be49d5187aadbef8207a8f928", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503976, "uuid": "050a786d-7d82-419e-94ac-fe6b5f30665b", "comment": "Malware payload (Mirai)", "value": "6e735fc60816b58a7460a8cd1e56efa5f6e8acb8574c15b9b6d71d96aae1e4aa3f42e419372329aa7c299b4f0c82cb93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503976, "uuid": "06b1610e-cd08-4cc6-ae00-5050d50b86e4", "value": "T1A1F2E163E2FA4752D4E9137B496C6A872510D038A4F4C6EEB4CCF57245EC30A2D297CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503976, "uuid": "6b0515af-f1bb-474f-ab10-80d451deea1b", "value": "768:wxvy5HnzodBQU1N/ZcCIEjp35wZ2P+nbcuyD7UrQRje:weHnzo9f/WromE+nouy8ryK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503976, "uuid": "fef4256e-42c3-49b3-bdc0-077560535f75", "value": 36116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503976, "uuid": "f2c2ec6f-b17d-4f77-83e8-18511e668329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503976, "uuid": "083f38df-e3b7-4789-97cb-e4eaf8083770", "value": "2ef219ea4bb265045b0f2174d38f1a70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ace1fb-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514106, "uuid": "95aadf30-e742-490d-b99d-25ed1e368615", "comment": "Malware payload (Formbook)", "value": "cb15ba4cd74138ec221502127a9c3c08", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514106, "uuid": "324d12a1-b415-4b86-9717-bb41a1b247fb", "comment": "Malware payload (Formbook)", "value": "4100549b9da5effac912ffe94fca5c571dc0bcb268f5b90c5449a2832e0d40a6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514106, "uuid": "2e88ef03-dff6-4b4b-b7af-39b3a5a92f86", "comment": "Malware payload (Formbook)", "value": "4705e0fa0cc797d282dc4f441d6c2f38a8b3fbac", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514106, "uuid": "6857aef2-5135-480b-939f-b83909b506b3", "comment": "Malware payload (Formbook)", "value": "163619c074c49070718551e2b0266da45db532bfd2bcf818a4ccce1984c16e9fbbdae56f9e1338cf9a4d9818a6f99217", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514106, "uuid": "1e25fcc9-75c0-4a97-9e01-09cfbdf40a4a", "value": "T19B95A831B1317A87C3161465265FBE8A430CBD47B2CA5F8C905DFBF82CA68E79306D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514106, "uuid": "5bf9d072-2774-402f-a66f-e02ddb7d5d46", "value": "1536:hb8BvB6egene/enePeneceneYeneueneZenePenegeneSeneweneEeneUeneuen2:mN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514106, "uuid": "b9f81853-07bc-472e-beba-5b50437e3e6f", "value": 2051550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514106, "uuid": "4e12b540-d49a-49de-ae00-c2460d6117a4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514106, "uuid": "de84ecba-4919-4f82-8647-3bf7ed36f308", "value": "RFQNJT5118F-220322.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf60bf4-9407-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552178, "uuid": "411bc0fc-112e-4957-8f76-39b9eeda2261", "comment": "Malware payload (Heodo)", "value": "395a34ef7a1c5c2aa4c122001da20bc1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552178, "uuid": "ae1d5549-f805-4268-87c7-d871d159f88c", "comment": "Malware payload (Heodo)", "value": "410d3ec6b79b784b67c7b04610d3bd8200760082be5f7bf7303b7c2424eb6122", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552178, "uuid": "b2b9a22d-93d1-48b1-9f17-0f7e37877d1b", "comment": "Malware payload (Heodo)", "value": "efd2690a64ee00fdd46e98285e09cc93b588b909", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552178, "uuid": "252322d4-cbbb-4d50-8139-1ad676643d90", "comment": "Malware payload (Heodo)", "value": "b01d2ff28b77fa384da95fe01d6533974b889b05089284818438219af6fc5bb770c71978b8eea1001be7f727a4e0357d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552178, "uuid": "a9348b2f-e948-42a3-a4bf-91f227f7a173", "value": "T122A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552178, "uuid": "6e0284a1-be26-4b2d-9bbc-8cd7f5358a98", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552178, "uuid": "9ac79558-bdbd-488f-acac-7d78de6a9e34", "value": "12288:vicw4w2Vb0zq6k5Z2mTijqkGXNrGHORQuBT:viSwub0W6LmTWwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552178, "uuid": "da54ae1f-1006-4145-a055-ce27ef4d46d5", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552178, "uuid": "84ce9f4d-3a03-4854-b9b6-3f50f2e9259d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552178, "uuid": "af93a7c4-bd74-46f0-8284-a749b1906c7b", "value": "h8kUOyoXG4FJ8g4H3nfJzKzX7uvN0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47089a32-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517592, "uuid": "71aded4d-8252-4516-b7e7-cf1546f346e7", "comment": "Malware payload", "value": "09d4d7ab66fe5aa2543cdecb489403d6", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517592, "uuid": "eb951094-182d-468d-931c-201e281b8d93", "comment": "Malware payload", "value": "41e0c19cd6a66b4c48cc693fd4be96733bc8ccbe91f7d92031d08ed7ff69759a", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517592, "uuid": "c45b1d07-d4d0-4315-a244-ae73436d7401", "comment": "Malware payload", "value": "e9e7b4e676d909c34bbb094ed4bb2f735fe8c45b", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517592, "uuid": "980e18e3-4e82-4760-b275-c2465aaab49a", "comment": "Malware payload", "value": "4b39ed52267189d652a9aa0b7f806d3d52ebd438fda76e3096effc8c97ce35e1b35c444d870b890a24bd42f6538aaa3d", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517592, "uuid": "84b05ce0-b6b3-482e-ab7d-2ce7fcd1bf56", "value": "T1A6A21709B7EC4B39F5FD4B7A5CB2864003B0FA06483AEB4D6DD9501D2D767808EA1B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517592, "uuid": "0ff5e69a-1081-4065-aa01-5d53ffa88c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517592, "uuid": "9856cd1a-d24f-4866-82ab-2de8268c43b2", "value": "384:yRS+Iw+M2MN8Yoyb8NhRYD5rFPwANog1Zlm/1iSOnZCTCzG3cLgqPqwMf+V:yRFJN8YoBEl8knZCTh3cBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517592, "uuid": "5a7647a4-8176-4212-9173-3fe76ce9f796", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517592, "uuid": "59059d61-cf1a-44b9-9944-dd517b9e8a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517592, "uuid": "92c3c02f-aea0-4267-a734-5f1857a8897d", "value": "41e0c19cd6a66b4c48cc693fd4be96733bc8ccbe91f7d92031d08ed7ff69759a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4e5973-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518303, "uuid": "d508d54e-7ca3-4bba-96d9-af03566a50bb", "comment": "Malware payload (njrat)", "value": "4629307fffdef51e32bb6295acd18ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518303, "uuid": "36591195-55fa-4e34-b6f5-611f02ff6bc7", "comment": "Malware payload (njrat)", "value": "420c7c5b6300259b7788d4612fd1bd20550e88c694cbabf2b9ff16c4e153d741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518303, "uuid": "ef9ce8f8-0669-464b-87d9-34cb3b10a3c4", "comment": "Malware payload (njrat)", "value": "8f147387bd3e80aeeb3bf81545e4e180640f4b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518303, "uuid": "7c5e94f1-15e4-47e2-b3af-77196b1f74ec", "comment": "Malware payload (njrat)", "value": "eeae5e57f21d40e2cb4d5e9307850c202047240be365e5dab6b4460f81edb256fc433142d66ce5b2f9eb9b825ae6fcda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518303, "uuid": "e53f4a7e-f267-4b2b-854a-cc0f39e85114", "value": "T1B293E84977E57524E1BF5AF39471B2004E38B4871602E39D48F258AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518303, "uuid": "cad3c8d5-7d72-43ae-84b6-7ef98c1edcbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518303, "uuid": "f7679b27-af29-4f26-a8a5-84d004009f6c", "value": "768:cY3Pu6SgmnldjcRoMwrx7Y+DIkIITJbXX6pOt8ux82WXxrjEtCdnl2pi1Rz4Rk3P:buYmlbrq+1NTZWOojEwzGi1dDuDCgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518303, "uuid": "4fe04a73-2082-4db8-ab81-13afc51abfe7", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518303, "uuid": "525e4e1f-b798-4957-86f7-ee26f15950ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518303, "uuid": "123bdd23-affb-48b7-89df-41d84d218291", "value": "4629307fffdef51e32bb6295acd18ffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e953d3a-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517577, "uuid": "634e0f0a-0ac4-4200-a1bf-fae7c88622fe", "comment": "Malware payload", "value": "c43bd29515ca9715923ac4cfaa389906", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517577, "uuid": "d297b5f7-b846-440e-b573-de5930144da2", "comment": "Malware payload", "value": "421361995be93e6bd4fba0735d805aed4ef182f43b31362e9b3c005925217c25", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517577, "uuid": "9a347d2b-2f33-4d77-a2e8-e0cc797be1e0", "comment": "Malware payload", "value": "70ec26836be4c097a167502588445532d820a431", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517577, "uuid": "79ff1e5b-cb4b-4dec-ac78-19caba0bda72", "comment": "Malware payload", "value": "3cdd11efab5aeae042ebc9812783b58f19bedf2e89155ca1d1b9d12809d599f2f5893301048eba1c5f06858dfc5155cd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517577, "uuid": "2ab4f741-26ec-4c4b-b1c4-86370ad6d8ca", "value": "T165547D02B3D7427AE5D74331278BA362DA72EC788672452B4249B50D3DF1594B7B32F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517577, "uuid": "d5092384-45b3-4fd1-80c4-ee0b2dbc0060", "value": "3072:rB97NIA+/WQx5TYD9yOePn7BN7bjwgz88ereWn/7w05g0a9oYk3DaAZFJdlr:reD7bi8er1nzTxYk3DaAZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517577, "uuid": "a61ce3f5-c0a4-4492-b8d5-e9f196049a97", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517577, "uuid": "0e0430f5-fce6-4cea-90f6-eebbe494ca3c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517577, "uuid": "7c93d3ff-476d-4e78-acb4-0db4d761bed5", "value": "_$ahvx or\u00e7amento-223288317672316AK462115.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf3c801-9412-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645556981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556981, "uuid": "2a01ba08-4083-4098-a5db-5be2b5764c21", "comment": "Malware payload (Heodo)", "value": "6a00502ff893721c9fac59580c88516d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556981, "uuid": "ab85ae28-b791-49b2-8faa-5c1cdbcf48db", "comment": "Malware payload (Heodo)", "value": "4238f4a1ccb4636b7f999d061e4a6a463b6f87f22cc92a07e149bc84b080934b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556981, "uuid": "9bae89f1-c007-478c-a09e-1e0e45b95318", "comment": "Malware payload (Heodo)", "value": "25d35842bdfd331d763b58d3b064bad2e7fa5e5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556981, "uuid": "4286aaab-0839-40bf-a400-495ccd3fc94a", "comment": "Malware payload (Heodo)", "value": "cccf474c2364a9283c49f9e011b25da5fd8d2a4dab27cb89a092c06e7aca6b4f303f3ea0a0261633e5692206f2fbd4e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556981, "uuid": "2a9c72ca-620f-4595-b0b1-667a204559d8", "value": "T1EBA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556981, "uuid": "454d2e71-d9d8-4fc9-9b0e-ac9bcfcd3177", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556981, "uuid": "714ea5ae-ad29-481b-b922-5228632c5848", "value": "12288:vicw4w2Vb0zq6k5Z2mT2jqkGXNrGHORQuBT:viSwub0W6LmTCwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645556981, "uuid": "d129fb84-fbaf-47fd-8812-1cb464b0855c", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645556981, "uuid": "6580c046-33f0-4533-81ce-23954801233c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556981, "uuid": "73158fe9-97ff-40ab-bbf1-230d516a8c87", "value": "6a00502ff893721c9fac59580c88516d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7dcfab-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517629, "uuid": "0ce7c6e9-89cf-4148-9de9-4c9788f07e87", "comment": "Malware payload", "value": "b463c65d44fec00adc75a1dd41dcf8e7", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517629, "uuid": "6b01c038-4512-4ef2-abb3-b17cca40beb7", "comment": "Malware payload", "value": "427c105859c3dc62ece790e41a42b0f6ae587496a07d3bd190143179cdf6c6bd", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517629, "uuid": "0bb99fbb-f3d9-4a9e-95d9-acb4e7d9d032", "comment": "Malware payload", "value": "f5566b0ed2bcc18218e054b008c9b3da5e3ca945", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517629, "uuid": "4da9784e-2721-4f29-b229-b0f889254957", "comment": "Malware payload", "value": "6003953df155d11d5326a78a5e39226c4f4f6f3b54d696d27207efb883de773f44d9dba45f405997823473e80b05bb79", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517629, "uuid": "dcb81ef1-2f00-46d8-aec9-fc54bdd920bf", "value": "T1D9E2E90637ED5764E2FF8BBC6CB26600097A794A9412DB5C2ED410CD0DB3B485992FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517629, "uuid": "a2721391-3326-4613-a6e5-78a60626d220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517629, "uuid": "ec9393fd-2e0f-4fc8-b604-dc0b08f979d3", "value": "768:i3BsVFCHzTw3tVSXkP1RFSDahpDkxDk99L:IBsVFGzTwi0TouvkxDG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517629, "uuid": "c23bac0c-ff0c-4170-9644-8c39e0f8668e", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517629, "uuid": "56ba7d73-b3a9-4b4e-ae45-48fe143038ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517629, "uuid": "4828b3bc-125b-4338-be98-7c78064bd079", "value": "427c105859c3dc62ece790e41a42b0f6ae587496a07d3bd190143179cdf6c6bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af05e932-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645514760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514760, "uuid": "c6cdd556-7512-44da-b0af-88ac1ac460d1", "comment": "Malware payload", "value": "f5155a4e65346169a1b8398b085ec086", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514760, "uuid": "ddb77ef3-017a-45ed-9314-ead3a317ad73", "comment": "Malware payload", "value": "42c542b9d10938111dddd7db6f43aeda3e651b2ec885030a3306e3b585aa4272", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514760, "uuid": "d48093ca-90be-491b-877a-2dadbd0f833f", "comment": "Malware payload", "value": "082bd69d30a9cec61a0042e02df44cda35046e58", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514760, "uuid": "94ed61b8-f165-47a3-ac11-05f2ff341d44", "comment": "Malware payload", "value": "f130dccf7d532e9a2b0f49d768a607bd087cba9720b1b6d8a08be5532ced0fba1c79078b162372a9f026bb4270ed4bd9", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514760, "uuid": "3740b95b-76d8-4860-b199-98ba78e3f849", "value": "T1BF23CF28D542560AC2A36839C47984D119769C13A205448FE1FEBE8F1BA8FDB275FBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514760, "uuid": "fce8285a-854b-4e38-89b5-806e93688698", "value": "768:B+TzRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnN:B+5JqHt7NJECQFfqAUIip1/K8NytsRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514760, "uuid": "ecf4fdc0-4806-422d-bcce-3e46de53651b", "value": 48031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514760, "uuid": "5d107209-11a6-47b7-af01-cbf90a95b91f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514760, "uuid": "a3dd7819-d7cf-49a7-8be0-e95701362cca", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86160efc-9392-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645501806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501806, "uuid": "5580dae4-6431-4cca-a177-25b0937f5ada", "comment": "Malware payload (Mirai)", "value": "ee0847749645e702a051d6fc02b6bfc5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501806, "uuid": "239f0fb7-0234-4ae5-9feb-78200b62e50c", "comment": "Malware payload (Mirai)", "value": "42d6aa9c99b21fb0a227498ea25d7c28d75f5def70575dc7b10c4f8973d84c76", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501806, "uuid": "52347b46-eea8-4fde-bee4-506d14ddb189", "comment": "Malware payload (Mirai)", "value": "9010891aba646db25d023158acb2fff407b7973c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501806, "uuid": "7c052577-5188-4f6c-a9f7-10a21597853e", "comment": "Malware payload (Mirai)", "value": "64898ec4d432c08824c78014f7013cd2fba3e67a89db5bcf2cbff0cf2e9df111ee58d4029a9fdb02597a71de9a4b8b46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501806, "uuid": "1d6735a3-1bd3-4ca0-8f9b-a99db491c61f", "value": "T11FA30986B9A25752CBC565F7FB0F0249771E87D8E2FD3203DD240FA0368A90F2D66981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501806, "uuid": "1264c11a-4b5a-49bf-8b52-4324d357c417", "value": "1536:Z6XQLwghSoxAdqv8BBwzylEuZd/RSb+63vCrWr4nSh+XLIBVOs2eYiFX3xKbF4F:wWwgooxAdqv8BBwzylEuP0ZRr4nShUID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645501806, "uuid": "d01658de-20c0-4220-849d-715afd1f0d1b", "value": 97952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645501806, "uuid": "19872141-d2b5-4584-b1a7-ac09462a4323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501806, "uuid": "c9988f92-40c7-4550-a7fd-501709d4855f", "value": "arm.cloudbot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652496ef-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517642, "uuid": "11f35118-4a86-43c7-b557-26dd36c98cbc", "comment": "Malware payload", "value": "cb14d849149831145963a44950a12851", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517642, "uuid": "a368a7fb-097d-4cdd-8bf4-991796bfa288", "comment": "Malware payload", "value": "42ed646eed4f949c456c637a222e7d94dd8ac67ed5ebda5e63c7b7979076d9cf", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517642, "uuid": "c454224c-23e5-4dd5-b813-36a8a728b6b2", "comment": "Malware payload", "value": "245961ca2c0646b2e0926e5281bc3398aceac7be", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517642, "uuid": "f37bddaf-05b2-403f-9116-ce7f404d92fb", "comment": "Malware payload", "value": "ed2ba384318636f9992f9527403a64a5021ba128898b04f15bd1f5214158459020bbcd0e37ff4c136b1b483ec221f617", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517642, "uuid": "1d5b3e8a-5a0b-44d6-be25-9fe7ee3c1b93", "value": "T19CF4383439EA501AB173EFA68BE479EADA6FB7733B07645D109103860723981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517642, "uuid": "233a9590-1720-41b3-bd3a-abdbccea3779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517642, "uuid": "e5c9a731-97b6-4217-9d17-0e9e60e8e307", "value": "12288:HAzkRdtjxoKXB3/WIavfVofPhGWvVq0Cyjru5WNgQuDNkct6qk9WM7skFB5l21lU:gQtYxkBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517642, "uuid": "2a64edb2-c28d-43bb-a498-5c0b48003329", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517642, "uuid": "15b7fe50-5e94-4b5d-b65c-d567011403b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517642, "uuid": "0b477181-19a7-4966-bc84-5464a65548ec", "value": "42ed646eed4f949c456c637a222e7d94dd8ac67ed5ebda5e63c7b7979076d9cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fc491d-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490079, "uuid": "64ab01ab-7bdd-412f-be0d-232881f46838", "comment": "Malware payload (Mirai)", "value": "b2307029db350caac48d26412b86a9db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490079, "uuid": "2fd6f36a-06a7-4670-8563-6a15c5baea56", "comment": "Malware payload (Mirai)", "value": "4328d27d9bfb0882eb47bf681bc9956ec74594cec75311d766a8069550b96569", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490079, "uuid": "be5f6799-e536-449b-b19e-efbdfb196c1e", "comment": "Malware payload (Mirai)", "value": "df2a8947247178edbcaa36276455330ae029d6a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490079, "uuid": "3eb3d7a6-34d7-42e2-af42-4099f72c1551", "comment": "Malware payload (Mirai)", "value": "d2924cffadbabb97d6bdd4dd53671762ebf0b97b922d1d69e3b3bf4eda7438519862c075373444099b43a4832edb3018", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490079, "uuid": "f106d84a-bef2-40d0-92b2-8bc5e2269d9d", "value": "T134834A3279752D27C0D5A53A22F74720B2F6679A25B8861E3C720F8EFF6068072536F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490079, "uuid": "67dedbc6-ba38-4cb6-9f42-bcfb922e159b", "value": "1536:opnSwSQt3aAjAq3d/t/eWmMIr3C9bBAkTpb8aFHs5et3au:wMK3n3ddmnBklrHcQau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490079, "uuid": "6771b9b2-0678-43b7-ba14-44ff5792de1e", "value": 83424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490079, "uuid": "5241a3be-afea-44a4-b6a0-fa47fe42b871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490079, "uuid": "8554f561-f1fe-4084-aa99-0541db4ec145", "value": "b2307029db350caac48d26412b86a9db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbc06b3-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528176, "uuid": "8f16f7cc-8499-4440-9f74-dcd1bd9170b7", "comment": "Malware payload (Mirai)", "value": "05242e13d217b368013a24da7c441a2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528176, "uuid": "3809422e-2a91-445c-a396-0a28a85982ed", "comment": "Malware payload (Mirai)", "value": "435379752c0ab96cb3bdcaee0847d2f35085607d7815bfd317c4286043c61f2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528176, "uuid": "23a2f0b9-32cf-4a25-b446-59c78ea65673", "comment": "Malware payload (Mirai)", "value": "890abc79ff80831eb66ad8178d37476a12d54519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528176, "uuid": "52968ef2-1455-45b9-9751-9d29a0803063", "comment": "Malware payload (Mirai)", "value": "21220db784359f804748daf70c449069adf512c36e3c24c987580d32447e0adc920a30bf61640052b5c004917cd30b99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528176, "uuid": "a766571d-2006-4116-a887-5406948019d2", "value": "T1DD53F946FC818A01C9C513B6FA2E118E33136379E2DF73529E106F6477CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528176, "uuid": "0f399847-c942-495f-afd4-5f8a893d7386", "value": "1536:Upn5zbm9xjLQAYWmEs4+fWhQczKnknVPiKlpcL9IwiAz1xZW1:Az6oA3mdTfWOczKcVqK2z1xZW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528176, "uuid": "574f7c06-8e93-4317-acd1-053a3e9110fc", "value": 63176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528176, "uuid": "5afd3aa9-a7a6-40aa-be29-35c3f758f706", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528176, "uuid": "2ab1f659-ae8e-4747-8fa9-11bf9dcf8e44", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9697136d-93f6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645544783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544783, "uuid": "5bc3c770-b373-4093-b33b-a70d76419339", "comment": "Malware payload (RedLineStealer)", "value": "bde49ef15ab9e8d47e618489307eb88e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544783, "uuid": "efdd919d-d9d5-4b9c-a7b1-27406b20e776", "comment": "Malware payload (RedLineStealer)", "value": "4404dfba77282a4adebab41e919b56b98fa820f9529ec76166a3c98c53450b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544783, "uuid": "fdba6a90-3dea-45da-bcce-08701d02864b", "comment": "Malware payload (RedLineStealer)", "value": "a5cf806c8344404101e3d7878604a499eeb9c51b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544783, "uuid": "e87838e3-c8a4-4e6e-bc47-f2b36ad7e24a", "comment": "Malware payload (RedLineStealer)", "value": "9e827c0cf7972740c3fd25dce74ee246e7f730e51fcde51f80e9c00ddfe65f02746ef5f5446c1373f3dfc38a5914077e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544783, "uuid": "5d6837dc-3fbc-405b-8597-0b8af94a4fff", "value": "T1C6363324AA881A2CF8C1D1B2768F2A4F1E33900D67ECB463AA775569DD1CE75610C7FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544783, "uuid": "bf2518e6-ed83-431d-95ab-2acc1ec39187", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544783, "uuid": "fa8ebbbb-5cb0-4a19-a433-ea6c16f20604", "value": "98304:KsjCHSRm6Sum2TpfQCilQx/NcSBIwLPb6gP5Lq6qXMsT:T66SumkpfQ8H/SwbmgP5Lq6qXMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645544783, "uuid": "251ec6d5-994c-4da9-b1a9-14a8bb1644ae", "value": 4866200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645544783, "uuid": "133501b9-d8b6-4637-990b-2439c183064a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544783, "uuid": "c6dbaa7e-9363-49fa-93c9-9ff719a2f5b4", "value": "bde49ef15ab9e8d47e618489307eb88e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d7fa16-941f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645562361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562361, "uuid": "20d0df5a-08d6-44fa-a0b0-a986e8f46902", "comment": "Malware payload (Heodo)", "value": "2cbb1dc168adea3cf5156cac2bc71c74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562361, "uuid": "0a54afb8-b4c2-48d3-ae3f-ba6ab14becb1", "comment": "Malware payload (Heodo)", "value": "4426f8035284dadcb6cca5c094b09bea7646350d99e21fcacc9044547242df99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562361, "uuid": "389443ac-9af2-487c-a9f8-cccbf4987b4e", "comment": "Malware payload (Heodo)", "value": "14fc8b6ec7e421e5c3b1a00c83e3bd22eacba953", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562361, "uuid": "31e7bc53-5c3f-4101-baae-0328b52e0b6c", "comment": "Malware payload (Heodo)", "value": "ab653b7a4b95d1c4ec2fa3374fcb9c280861d59d7d1d9ab05bedda85f322bb2dfeba1e0475174ae0a64eb182b07ecea5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562361, "uuid": "1c124acd-1402-4218-8f85-f53ab3223ba8", "value": "T1A2A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562361, "uuid": "0a17a526-fcae-44e9-9f6a-f4e01c87357a", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562361, "uuid": "0076f87d-0ec3-495f-a8ff-1111814f3cf2", "value": "12288:vicw4w2Vb0zq6k5Z2mThjqkGXNrGHORQuBT:viSwub0W6LmTHwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562361, "uuid": "afba97db-deb9-4e8f-aaba-f029afc8580b", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562361, "uuid": "f295f824-dab8-46a0-b4a1-b6f4891b9f59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562361, "uuid": "b1bfdcc5-82fe-4c4f-8d73-bfa1cb1373c1", "value": "2cbb1dc168adea3cf5156cac2bc71c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848e4dd9-940d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554632, "uuid": "e459f655-d605-4555-a634-fa20fba154ee", "comment": "Malware payload", "value": "84f6a8452131efb1b20de09f84f853e7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554632, "uuid": "c157f47a-9611-45e6-8268-5ee70ae88406", "comment": "Malware payload", "value": "4474d55a2152a0a23dc15db3e10773aa6a48305350e120de265b443caed8ca33", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554632, "uuid": "300d2d66-85c1-4d9f-a814-2a6eada1ca3c", "comment": "Malware payload", "value": "86a16a314a43ed38275ead5ddc380ea72d3da66b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554632, "uuid": "941987b7-1837-4b02-a26e-b73bbb4d74c4", "comment": "Malware payload", "value": "193df9ced50c8592d167c4236c45abaf184d7bed1733eae9ef85ea4d20e90cc38f9ce93deedcd1f98076ec693bab3a14", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554632, "uuid": "1bf91cc9-c9e3-46ac-bf59-576bdc8e1f29", "value": "T16193F769B681C95BCA5807344CD7CBF67227BC424E7987873258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554632, "uuid": "f3966e9c-001a-4a37-9fa6-26abb2971202", "value": "1536:Kyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGAkWvgrPE4nWHPNc2Ap:Kyehv7q2Pjx45uoDGTj+5xtekEvi8/dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554632, "uuid": "18040c05-ca59-4e2f-a22a-e5ddb50d3278", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554632, "uuid": "72f33aa1-f800-4b95-b717-5763257e7fcc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554632, "uuid": "ed94e1a8-f5a2-43da-98ee-f7fbce52f9ec", "value": "tmpegtmmubr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0580106f-940b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645553559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553559, "uuid": "3bf8c13e-593c-43a8-955d-8782de67ae6a", "comment": "Malware payload", "value": "be8f38d283480139af6fde5ed7fb9e5e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553559, "uuid": "406b2961-9700-4380-813f-e35a332bec23", "comment": "Malware payload", "value": "462c922a2dfe7f1775beb601d85ea7b59e201c636db4c65e0e611bd1b346f35b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553559, "uuid": "f41fc70b-8564-45b7-8a1b-f679cab6b59e", "comment": "Malware payload", "value": "94d8129676dd57da8006150d9c4b9d0f409c4789", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553559, "uuid": "fc459b41-52df-4ff6-89d8-59e44b659d4e", "comment": "Malware payload", "value": "ef043ceb2275b8bd9cda53a58823d21e45e6cd37a506f3ee8801eb131af5b8fe3a262da2d123d587d9dc52faa03ceb43", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553559, "uuid": "2654f2f0-f869-4dcd-8bb8-30499a3ff666", "value": "T19F93F769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553559, "uuid": "8a389151-3154-43fc-8566-51f51f2ed964", "value": "1536:vyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQsRkWvgrPE4nWHPNc2Ap:vyehv7q2Pjx45uoDGTj+5xtekEvi8/dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553559, "uuid": "53dd32fd-1a12-4da5-bfb9-e495ba8b2752", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553559, "uuid": "8f7628d6-b890-4892-b43a-73ff5fe56b00", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553559, "uuid": "116dfd9a-b7a1-46d8-a214-b800bb170caa", "value": "tmp7p9qr6xt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff552a5-93ce-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645527646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645527646, "uuid": "fffdac82-cbb1-4aac-87d5-74425089413e", "comment": "Malware payload (AgentTesla)", "value": "69721edaecbbdfd3261f606792d68ecd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645527646, "uuid": "6d131aa6-a153-4341-8de1-4a445810c3ab", "comment": "Malware payload (AgentTesla)", "value": "46696be022ae2fbbb64a68362b3eae8f5b6c6d3883598963e65c7bb1a2646bb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645527646, "uuid": "8ca40dc6-3420-4bb6-9abb-19615d90f679", "comment": "Malware payload (AgentTesla)", "value": "f9e74c4044b3297b509b1eaf62e92e3262ceffa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645527646, "uuid": "985d680d-ddee-4a3f-8196-adc5bb5ee033", "comment": "Malware payload (AgentTesla)", "value": "3e67515376050de5963955a04e4d86f6ad57656bd676f67688839706dc74ad3ba0bd4a919997eeeafa49e42ef012c8ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645527646, "uuid": "5a78be8d-3b02-4e90-9b4a-4b3f88752fbf", "value": "T1F53523EDE1D1BDF6D65AA6FE369084004FF3D0501E766EE96285B0CB146EB103B0ACE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645527646, "uuid": "b27a9052-4a0c-4d6b-b354-1835b20246d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645527646, "uuid": "abb67dc8-44aa-4c85-b904-d0676ea9f701", "value": "24576:iASTW9UksnHbEVidTWkhM8/26HGqEv2T/YaBN+:iFYUkqHbEVidTWkhMQ3j02Thr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645527646, "uuid": "a226b533-21c5-4a32-8faa-0d4d42c5c011", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645527646, "uuid": "00b881c4-3881-4a53-8ff4-e0512fa5839f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645527646, "uuid": "5db27c6f-0979-40a3-b000-78a1e84c5b9b", "value": "SecuriteInfo.com.Trojan.DownloaderNET.322.6772.21083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f5e53b-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517587, "uuid": "e6a78d7a-9fa9-413f-a9de-f1eaf62a092c", "comment": "Malware payload", "value": "89b1af50426afc50432015ee3aec5f6c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517587, "uuid": "084868ce-0424-41d6-b98c-4e7bf2b8ef0c", "comment": "Malware payload", "value": "466caacba5e5830132bf6db74ee2b6f202676705ab38e6b989d559a302eac75c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517587, "uuid": "dc1386af-39f2-49d1-86f7-31294e314d19", "comment": "Malware payload", "value": "b89eec0485f0a780a6e59d3dd64b815c379c6645", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517587, "uuid": "051e83c9-e7c2-4c31-901d-bbc9e7535474", "comment": "Malware payload", "value": "072878b451bb112335816bc544d3f8ca18712d04a498a50fbfcc19556936faae3b9a95f1169dbe65bdc8f87ee0d271be", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517587, "uuid": "0fdf915c-07d1-4e4e-b747-0437e1ab1e40", "value": "T1EB446C06B3D7427AE4D703312B8B97628B72EC788673422A1649750E3DF1594B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517587, "uuid": "14f9228a-624e-42cd-95e8-94d9d014328b", "value": "3072:qB97NIA+/WQx5TYD9yOePn7BN7dJwgz88ereWn/7w05g0a9oY53DaArpxJ5:qeD7dE8er1nzTxY53DaAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517587, "uuid": "0aa56baa-e0e9-4184-a4b5-7701e1ccb212", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517587, "uuid": "fb59765d-30ca-497a-9199-ab3e21a1d936", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517587, "uuid": "b082dd3a-a49e-47cc-8c4b-7c4226809ffc", "value": "_NF-e.d`as2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8542048-93c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645521728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521728, "uuid": "11b233bb-70ba-4fc5-9033-4a7a60fdd45f", "comment": "Malware payload (Formbook)", "value": "6ec38c4638933adf4e6431c599572869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521728, "uuid": "ba8a4046-08fb-4c19-b0d2-8dcf8aa2a62b", "comment": "Malware payload (Formbook)", "value": "4693178ae42f25930859574bbaa0b9eb93a011b9233c43639c53689ecd47a15c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521728, "uuid": "d20e506b-75c1-4815-b933-f276c685e812", "comment": "Malware payload (Formbook)", "value": "7daceef37fd49f19393b9cc0c03b5bd0625b6eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521728, "uuid": "e0ad9a8b-7c45-4c48-bf98-7a303606c524", "comment": "Malware payload (Formbook)", "value": "d5e6e69a50a36e4d1eebb4c64e265d3e7a7cadd8f57f99aba05a768b17a6a473b33a6e262c4d25a884a157f50c419519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521728, "uuid": "31891edf-aa7b-46ae-8750-0afe85fae520", "value": "T10A5422EAF48544E7EC6A57372DFFB776E1F2C30834B04846AFF01DA1685109B1B68296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521728, "uuid": "033a8229-3585-4aac-915b-fd8e2f4b68a9", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521728, "uuid": "4bc5b42a-33ed-42d9-b279-b249020f8c72", "value": "6144:owgA2lrSNPl57OIvCzMsYsl7xgWg4ZEOGvGxKh0u3W:slm5iIvRUvPujeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645521728, "uuid": "1ba1817a-0d63-4c88-8818-58352476b9b0", "value": 301878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645521728, "uuid": "767efdbf-81a7-4092-a20c-32eb98e1eb58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521728, "uuid": "620760a9-f98d-4651-ba39-6eeed1fe75ac", "value": "MV LILY SEA_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e9b4a3-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514749, "uuid": "16dcca73-063c-4c86-9289-5c3009ea9fef", "comment": "Malware payload (Formbook)", "value": "42c9b109947565bb6a7b8f314468af19", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514749, "uuid": "39a2e3cc-466c-4835-a569-daf9f17d8ce0", "comment": "Malware payload (Formbook)", "value": "46aa9899840a62d1dd93c5ff6e2ed489d401290b4e5ff1d7b6560ca9cf856519", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514749, "uuid": "ba5d5f8a-f244-4b65-843a-e3d6e09338e6", "comment": "Malware payload (Formbook)", "value": "2b616ea940151616e4bf3dd1dfebc1ce1e67166a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514749, "uuid": "cb208fad-2f8a-401c-897b-19fdfc5418cf", "comment": "Malware payload (Formbook)", "value": "5dcd220ea8e92a89736925003e8b1f49e76f75a0c9d5cf903c4780b77ee1d8453e806046faba4b1ae12929c43763bf8e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514749, "uuid": "cc9da1c1-c366-482c-8d30-2ee75d27392e", "value": "T1D3F48D48D7565AC5E8E54A7985FA5B112750BAB18DCBC30772AC253ECABF3B43E4028C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514749, "uuid": "4ed188e9-d223-49b3-b42c-5210b30ec75d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514749, "uuid": "6615e89d-0e27-4a25-b869-589868bdf59d", "value": "12288:hYdSpuu7l3sHPCNH22qla5w/yXbxlih5tndgnyBQyGf+v2aPkmQQ1v+J4bBG:GCuYl8vCNH0MW/IbxlUndgnyBQyGf+vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514749, "uuid": "d5b6ef11-c708-43b7-8ebf-38e868d1f723", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514749, "uuid": "ec2aea0b-1738-45a0-acf6-7d98c3cc1ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514749, "uuid": "20b5626c-a37f-4f17-98d1-b464674d3c68", "value": "Shipment Document BL,INV and packing list.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267b384b-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645539012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539012, "uuid": "a04b9ce1-d5f6-4e64-8ffe-70d3ac6cf724", "comment": "Malware payload (Formbook)", "value": "ec047de6e8208573ad83eddf32681a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539012, "uuid": "195538c0-d506-4235-8b50-f2d54c622ae9", "comment": "Malware payload (Formbook)", "value": "46c2da007a993c4b1ecfa3ff91364bc98341c9c228517eac38b50c4567fb78dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539012, "uuid": "c5105b68-44a9-484c-98bb-6b8bb9cc1481", "comment": "Malware payload (Formbook)", "value": "e92312a50f767b38be613caaff4e65898b7089f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539012, "uuid": "6a8bcc29-f8bc-4039-a6d8-e8c18d9cdd1a", "comment": "Malware payload (Formbook)", "value": "4ea655219f2be2fa3febb591e3128d7a3f2911f7532cf9ebefc8e82f84c65ae8f75896088048997e17716114c25f7e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539012, "uuid": "a4bc60c5-021c-4801-af3e-ae252003c397", "value": "T15D257D22E1A08833C03719349D1B96559D2ABDA03E3CD8867BE47F9C1F356853D39EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539012, "uuid": "ad53916e-c555-431e-ace8-e3dbeb224fc4", "value": "fa9012f26f19d2b57997adcc6f3bb5ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539012, "uuid": "273ed3ae-bb7b-4cd2-a0f9-3f03045fcf3e", "value": "24576:AulcKxxVbDbzL4bMB8lh/XZ4EuuGKGw5WEd3/jK:AjSbYXqcZLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539012, "uuid": "4d22b630-b796-49eb-bfb1-3082f1cf173d", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539012, "uuid": "422087d1-4b74-488f-9b73-7eaa68321c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539012, "uuid": "5ad5924b-cac0-4d85-a464-3f9db5f751b7", "value": "Sifarislerin siyahisi. 02872615415415.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc8dd84-93af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645514358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514358, "uuid": "0a50a159-0ebb-4c5f-a0c7-9a70fa730480", "comment": "Malware payload", "value": "e3ea88c59ccb9026951a0e9fc762ed0e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514358, "uuid": "522a0e32-7cbf-4596-a131-6ba4f6833601", "comment": "Malware payload", "value": "46f51501dc250ebd1c8b208afa6765b315f74ac99ae34f93b971405803180f4c", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514358, "uuid": "ccac1bbb-48f9-4507-88d0-d71777bf7836", "comment": "Malware payload", "value": "cf24650e38f4985d9855b57d248e8de0df2a32ad", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514358, "uuid": "9ca1dc32-2502-4b77-b728-a07b88beafd9", "comment": "Malware payload", "value": "d4f094e85dc21b911f858e31c0524ca9b07e64b1d402f3adba8c8e5e77555807ce38981edd0a9ceddae70e13c475de2a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514358, "uuid": "2e3f4d5b-4c38-4f06-94d3-d9e778786ffc", "value": "T16314128B772089EAE65A7CFC87C7850F551AFED092BF207B34877A47A4703A550F8426", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514358, "uuid": "a2eb1050-68c7-4f5f-b977-fa1969b37a41", "value": "3072:iR6qdakyE5ENvk2192bxdPypCM75O+VJCVmeW5+r7hYWstC8C3HCNR651SqC9l:Gxr5EGQobxdPypLJME81Cj65w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514358, "uuid": "6bd478db-203c-442e-9d13-5cb85fe7cebc", "value": 191448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514358, "uuid": "2c85daeb-49f7-4526-996e-b3cebfac295c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514358, "uuid": "9d44d10a-3a9b-4430-a435-9bdb9a44a62c", "value": "A2_Documento de env\u00edo.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3913791-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554281, "uuid": "751a382f-633e-4bc9-b8e8-ccdd5fb8f611", "comment": "Malware payload", "value": "3cd353e5a32fcf5c839da70834fd5f5d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554281, "uuid": "18b6fa19-8d0f-4f9d-90e3-6aae63fff3b8", "comment": "Malware payload", "value": "4757c6db431c7c55e0f56c1c58426d5a64260226a670d9b553b3606becd96df3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554281, "uuid": "8ba9037b-673e-4e3b-a58e-e6b4faa7a0aa", "comment": "Malware payload", "value": "0e315e78df23b0fe94ffcd39082200ac138c0ca2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554281, "uuid": "0b21ff63-4c54-40dc-b20d-5f21e702fd86", "comment": "Malware payload", "value": "bbdd096323d25d10af2166f545ac9b822a86c670dfd960d6f42a470c83b0c1957d996b1fe135d2e71989ffd4bfb83fc7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554281, "uuid": "660ee8e9-90bf-4eea-ac77-8c08d4751c15", "value": "T1EB930769B681C95BCA5807344CD7CBF67227BC424E7987873258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554281, "uuid": "17654564-f152-44ce-a668-2dd6c4688934", "value": "1536:iyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGFkWvgrPE4nWHPNc2Ax:iyehv7q2Pjx45uoDGTj+5xtekEvi8/d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554281, "uuid": "8a0a975e-da75-480e-a66f-b94195536c91", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554281, "uuid": "49b250ed-fbef-4ee2-9d1b-c8a55adb09c8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554281, "uuid": "40db3973-126a-48a1-ba85-05e5754ae697", "value": "tmpxp6t5zpy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735caa9d-93d4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645530121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530121, "uuid": "35c10149-7437-4daf-9a88-833cca73b153", "comment": "Malware payload (AgentTesla)", "value": "a151411836b0746e71b1511f46499c14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530121, "uuid": "7d1fb699-f3bf-4e48-bf9c-cced926ef3ee", "comment": "Malware payload (AgentTesla)", "value": "47941529f951805b1f48857c036e492f24196f021ead8e827081baaeed10ea87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530121, "uuid": "a2de0200-3c13-447d-9191-c67cfe7c617f", "comment": "Malware payload (AgentTesla)", "value": "cf83da55a1873e0b2fd4eca209c3b82a1faa11c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530121, "uuid": "c379463e-8b90-41f7-a1f4-0817d6021ed8", "comment": "Malware payload (AgentTesla)", "value": "3b036a0ac5331ac188ee6856bf7e6f63da95b77578a3393d052dcd25be776467834c2b7c861ae24e821c6d7644c47b62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530121, "uuid": "bec9b1da-06ef-453b-a1cf-1a4684503222", "value": "T16A354B9D365072EFC857C972DAA81C64EB60747B930BD203A06316ADDE0DA9BCF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530121, "uuid": "79ff841c-2b46-4880-8906-08c8bfd63ef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530121, "uuid": "738a664e-9822-4192-b901-ede2e96dd922", "value": "24576:hLw1i6M+ccbz+XS9q6+irEwnGm+aP3UItzeUOkiQK6o:hL+2+cs+5iNpTP3dtz1Ok+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645530121, "uuid": "721a893a-413a-4053-ae32-dc2a4d226a32", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645530121, "uuid": "4a2184f1-edba-4851-a085-1c090eec1038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530121, "uuid": "805b4c9f-0093-4919-b3ed-55e64e9c13ff", "value": "0000002064.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c693362-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531774, "uuid": "60c9dd4e-4924-4f9d-be7d-ad3ed877d2aa", "comment": "Malware payload (Mirai)", "value": "96bcf84248d097ff07aed4a02efaa8ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531774, "uuid": "a908b0cd-af7a-49ba-9dad-5b25fe190121", "comment": "Malware payload (Mirai)", "value": "4798719bedcb99b725709d42abb7d045f41fe72640f41dbfec419acaab9ced45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531774, "uuid": "a403b315-8622-4a53-a9b0-9d37acb4a497", "comment": "Malware payload (Mirai)", "value": "e3964bc092cfdd69281cc4a18215a3b96f2e86f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531774, "uuid": "9184223d-8a05-473e-903a-81164d0fb06a", "comment": "Malware payload (Mirai)", "value": "1f94344ff79fde2cc07634da2b5ed33aa8ce89d9158e32e6dd88d9c02561d05636c0c970a634e542b5f2eeec2dd2df35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531774, "uuid": "b94739cb-2d97-4dba-8bfe-722c23de1f59", "value": "T1D493B30ABB740FF7EC6FDD3749A92709158C650A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531774, "uuid": "7c363d67-7f54-48a3-9f06-077bdd4c01de", "value": "1536:zahaNVXMDW/JbtjzYvTIqI3Lk/0B/BXsZiaBLTe:zahGVQWNt/Mh2TXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531774, "uuid": "5cdb099c-e442-456f-b0ef-0d3a9975a21b", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531774, "uuid": "0db31254-379b-4b20-bed8-b9f8725d214d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531774, "uuid": "1cd7e66f-877a-4a0a-9f06-6b41aa0a5888", "value": "vcimanagement.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716cbd94-93c6-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645524105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524105, "uuid": "4116c256-827b-487c-9029-738f7493a2f3", "comment": "Malware payload (AveMariaRAT)", "value": "d2fa751c477c994cf56a6c9a74544eb9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524105, "uuid": "533d78ef-6ee1-47fd-9708-5264ba334e32", "comment": "Malware payload (AveMariaRAT)", "value": "489a2e9c82e83a219e62ded379b4dd8323be026889a3453bc97f0cca67a8828d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524105, "uuid": "16ed24c1-a2ca-41a0-8285-a323b640860d", "comment": "Malware payload (AveMariaRAT)", "value": "997371c421acdbcb642f7c159d58c77f045ebe3e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524105, "uuid": "404c1a53-607e-4256-a78f-c8aff0ed2b56", "comment": "Malware payload (AveMariaRAT)", "value": "f296f6cb4e311522d044c2b8192270c1dc3d76f279c52670c982036f93a0bf3ad7b18381f1cb1ecf10e3e1312bacb751", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524105, "uuid": "379ba4b0-614c-4b6e-aa8f-08fa89a9a466", "value": "T1F363AFABB344D6D3E49D12B5AB49D2B8C532F63217AA63781C958BC75CBB3188F015F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524105, "uuid": "b655e6e4-852e-41b4-87a1-d2ad99b8bc83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524105, "uuid": "9001b5d6-32b8-4dfe-a463-fc6b9cfb39de", "value": "1536:6Vdv49duGRjCuJYzRjNzb0Eo1LIynZ1m4:VjJYX0LIynZ1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645524105, "uuid": "a88a0ec5-0a96-4403-9935-d9fe1ac4a218", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645524105, "uuid": "9452d3fb-b452-4458-bbee-143186e13a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524105, "uuid": "79018055-7c4a-4ac3-bc92-4fa752b24e40", "value": "PO - Drawings And Specifications Sheet^PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32da5b93-93a9-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645511545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645511545, "uuid": "c3a613fe-866d-4dea-bec3-1208e9db7451", "comment": "Malware payload (AsyncRAT)", "value": "f10f0ffaa54a5cde5d57b6e2c058c5f6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645511545, "uuid": "b5dfb340-b0d8-4c1a-a58f-2a2bde3dbc62", "comment": "Malware payload (AsyncRAT)", "value": "49106de5f1bd7ebcfb1ec5f52291ebeb819d2cf6d6717e0518a777c94ef63eac", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645511545, "uuid": "88822af8-99f3-4195-b5d7-eb1594d1b908", "comment": "Malware payload (AsyncRAT)", "value": "b35faa2afb20c80a02e014d3ee3b53da57af6d9e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645511545, "uuid": "f49cb529-e7e3-4491-802a-9dde8fdc5ae5", "comment": "Malware payload (AsyncRAT)", "value": "3e9363a26d447d648d16d1caf2b71f6a7d7340b20040cf56c0ccc448ee7e063785239cfe88766f467b60fa1fe12b0789", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645511545, "uuid": "51d7752b-2d4a-45ff-a338-6f9dd15853b6", "value": "T198D4C750BF903ED7C831DB77CAF14AFA2332A11016FE162B756D586F4F5B8946B81288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645511545, "uuid": "6c7a59d5-482e-42a8-abd5-1429ced74268", "value": "96:5+B8jzvyEccS3WXRkfCqd/CB7NGeeZ3klwe/Fi0SYqp8ka7e:OIzE3WX2aqd/CNmeNi0K7a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645511545, "uuid": "286970b3-6cf1-488f-814e-8a35187e1c7e", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645511545, "uuid": "998f6fc6-b1b8-46cc-82ba-27e8aba3a888", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645511545, "uuid": "08d1cc86-5f15-4480-a99b-659044ca8229", "value": "TQAPXOKRNLAWS.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef79aa38-940d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554811, "uuid": "20e531c7-1e95-4767-be61-a1daa53090cc", "comment": "Malware payload", "value": "fe3a4133c58ab9f795f2500230e0e1d6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554811, "uuid": "4d20e6e3-3ed1-4342-b126-e2e87a026fa9", "comment": "Malware payload", "value": "49879483e1caca3b9cf6cdcea79ffbb52f46c5f126176af2a79c04d9aa4448a9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554811, "uuid": "35e1b5bb-a211-455f-bb2b-eeed768579ed", "comment": "Malware payload", "value": "895f197da2addea135e452b1294b3bf614411ecd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554811, "uuid": "7b79e91a-f4ad-402f-9bf1-a1465f0c51b0", "comment": "Malware payload", "value": "1a276a243fceb727aeccbebacdec9c3024d0391981f9f092d4ed343e45a564ec0dd0536da2aecebc143a269ba6d5658f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554811, "uuid": "ae9d2078-b53b-41e6-aa2d-59c31c545a6b", "value": "T17E93F669B681C95ACA5807344CD7CBF67227BC424F7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554811, "uuid": "9eb57084-139f-4fe6-a61a-3eec3a95f5fa", "value": "1536:wyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGYkWvgrPE4nWHPNc2A5:wyehv7q2Pjx45uoDGTj+5xtekEvi8/dK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554811, "uuid": "19c902c8-236f-4c9f-8025-220b2d6d0693", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554811, "uuid": "8840ef5d-75ed-4437-89dd-ff9392bf33f1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554811, "uuid": "dbb9f84c-5422-4571-8636-53787d4131e3", "value": "tmptyzxeco7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707eb577-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503917, "uuid": "35fab7db-192d-45a0-864b-04d617411e1f", "comment": "Malware payload (Mirai)", "value": "b4aff1933afcdbca281b8b9e4e63dfe3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503917, "uuid": "3ea83158-874d-4bc6-a860-ecbb2981601e", "comment": "Malware payload (Mirai)", "value": "49bee223d4563e1b83a996f906433a4b430a1959591db60ba0ce3579166cabc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503917, "uuid": "cd6f97eb-7474-4acd-a5dc-af949a6a9d38", "comment": "Malware payload (Mirai)", "value": "1de3fb0ced892e53a31557bee4d50548f6e68549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503917, "uuid": "c33b16ad-795e-4ed1-a7e3-dc27fbfa561d", "comment": "Malware payload (Mirai)", "value": "f49d2c153d080e64edb1f72b4b948a8b692716a8e45432dca4b00bbd29bb68425fc92275a47791544e9d09996c800840", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503917, "uuid": "733ee3ae-8b1c-44ed-bfa8-dfd5a26f16cd", "value": "T1CE23F14167BCB8D3E7F33A71C86207C575E81AB1F36F70804855956227C912AEA68AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503917, "uuid": "9a428fba-2ab6-44e7-86a6-77f3924847f9", "value": "768:8EEt6aLvkDzTFHrI6iAYnwXGSH8obu++tCqi2dshteWXUd5anLC7Jku+9q3UELjp:LEMaoDtLI+XXtczUqixhtEKnOyujLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503917, "uuid": "7e23ff8d-29d7-419a-be2f-726ca2200869", "value": 47740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503917, "uuid": "f2fcd8fa-d4e0-478a-8b60-6f89b89c7052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503917, "uuid": "a5d2db3f-e876-4fad-9a7b-06c45720d04c", "value": "b4aff1933afcdbca281b8b9e4e63dfe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed35f0e0-9407-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552230, "uuid": "6a9c0be5-e6cf-4e92-9bbf-ad0455ff6726", "comment": "Malware payload (Heodo)", "value": "4667b2153f09fa65afa519e6abba5fc9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552230, "uuid": "56b6bd3f-4f47-4920-9b18-7c5ba55d9c7a", "comment": "Malware payload (Heodo)", "value": "49debe82b014bae8d3045f7759222d7a074fc41ff189f283ab687373480fcdd6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552230, "uuid": "6e530592-dc10-458b-ac57-6b7d1160531f", "comment": "Malware payload (Heodo)", "value": "c53d474569a0d3c8efbe973936a0b5e7de91d5eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552230, "uuid": "40e4d032-f32f-4ae8-919c-19758e4f2318", "comment": "Malware payload (Heodo)", "value": "a869a93f06841816d114d200f51394c534a2f7a8e20222a6a0544253b8599e727fb2c2a236963060847fc7dcd8399307", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552230, "uuid": "0cc53bf9-a580-4c37-8900-01e27ca6d9cd", "value": "T159A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552230, "uuid": "8a4e4bfa-93ce-4a43-9093-ccea2ea37d85", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552230, "uuid": "3927a740-1b07-4fff-85ba-f35c1fc6cc6c", "value": "12288:vicw4w2Vb0zq6k5Z2mTVjqkGXNrGHORQuBT:viSwub0W6LmTDwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552230, "uuid": "20942fd7-7b65-4ce1-bb1b-1bf3208dc009", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552230, "uuid": "76cfc008-d513-447d-86d7-f68a44194923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552230, "uuid": "e57127b1-d424-4d21-b333-a26d8235f6a9", "value": "802sNhBm3mo939QqW7lZPqy9IChAAK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3142f5-93f5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645544394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544394, "uuid": "1d01ca4d-8305-466c-a06d-5af0a55f746b", "comment": "Malware payload", "value": "7285498b0d30569338b5e83d62c2bffb", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544394, "uuid": "54f05a2d-20c0-4110-99fe-08fd41163cb3", "comment": "Malware payload", "value": "4a59d722cb4663d9d8d5e26016a348dd44e9f5e14d0851fc814e1662e581ac62", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544394, "uuid": "fc2835ed-38a1-42c0-a198-9851002f64fd", "comment": "Malware payload", "value": "08edce1657f84d1f782f1a07010d39c6992324b5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544394, "uuid": "a7102788-0336-4f01-980a-85d1bc74eccc", "comment": "Malware payload", "value": "5586be1f9d345a5100b13fa938bc09a552deb8b08caf816e06a4ca7182f21fac555dd0587cbd0068abfe9a2bc2386cef", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544394, "uuid": "ec8b653e-b19a-4618-8f36-acf16acf14b4", "value": "T1B8A412E8E0C522B8E6DB9730105C09F853D22E7F6246A3C41A71674BC181B7A7BCDB79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544394, "uuid": "2df01afc-b531-4318-8f40-39f6d67b0543", "value": "3072:OF2s3kGz3bPrSGPRQaQF9CisSk9FzWFzLj143U4KSE:OF2s3kgPuSmdlkilLj1QLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645544394, "uuid": "37ceaa61-ffa0-444c-a20d-97fb73a081ff", "value": 467117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645544394, "uuid": "5d409a53-ca83-4e69-9ec5-62e83b83bb20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544394, "uuid": "1fab515c-8993-46e0-9655-c2435d26fcc2", "value": "KHSBXNS_INVOICE#02HSUEQ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841e85ce-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645517265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517265, "uuid": "23aa072a-d506-43dc-9c64-370c3887f051", "comment": "Malware payload (AsyncRAT)", "value": "a673f1b64b97384cdb86e148a94188e8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517265, "uuid": "c432acba-3116-433c-a584-91d760aaa96e", "comment": "Malware payload (AsyncRAT)", "value": "4a9683f3b6658f4895cd3d44c4920d77db5dfd410cf0dc188e4f4d2740c24539", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517265, "uuid": "95931dc6-1b85-42b5-9a10-bc372800e05f", "comment": "Malware payload (AsyncRAT)", "value": "2f924ea70a3a8c7b3c5808af437cb895f90f588a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517265, "uuid": "dc755086-7199-4f35-8195-b8051cde90e8", "comment": "Malware payload (AsyncRAT)", "value": "d6a1e7083da7148b7d0318cb0e34442e9d898b828dfb3cc1aab09693360fea8b41bffcd59b6f5628fb6a7c1db2d055f4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517265, "uuid": "0775a27b-7886-4470-98a0-f8134a86e8bc", "value": "T1E7D46D55BECA6EA1EFBF47B78361D62D0126736E03A0A6CF6643019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517265, "uuid": "96282d95-363f-460d-8346-d6ae32a078aa", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517265, "uuid": "39d2a0be-2a1d-461b-a9ff-699f3e6283d4", "value": "12288:O0Ws7IMsR4yVld8bzbBSreOBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqjj:O0bskX1eBY4ZyrE7K3yl8PeVooA/AB2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517265, "uuid": "094a11d7-2ba5-4498-9816-8b2fcd6e7adc", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517265, "uuid": "de0f37d3-c9e2-4dff-ac1a-4e92144ae042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517265, "uuid": "0d81a0d2-1835-44dc-9f22-d92906647b2f", "value": "Factura 0000000065.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da004790-9411-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645556493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556493, "uuid": "15d43545-72ac-4bb2-95ed-d6b8cc7e5cb5", "comment": "Malware payload (AsyncRAT)", "value": "487079a3e5cd167fb91c3e3734c40153", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556493, "uuid": "e772b137-27f0-427f-b78b-5b777da522ce", "comment": "Malware payload (AsyncRAT)", "value": "4ab15234cdc0baf746b77352e6d47af4643544c48c32653bd215c6e5296b6f3c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556493, "uuid": "94f6eab5-52e0-4181-8590-b2450d159010", "comment": "Malware payload (AsyncRAT)", "value": "1297d77e41665c872d7e6272f73b7ee121c1e8b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556493, "uuid": "549ea259-2a13-479d-a329-d1cba1440c9e", "comment": "Malware payload (AsyncRAT)", "value": "d767102884cc46138c7d5dc7841f49b2f8396a0ecb726648575466a3e4e5c0dd095202aa027ec966f4b87963e018cedc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556493, "uuid": "8dd0a875-acb0-4f0c-8fc9-54e08a04b322", "value": "T1EA718374B0247AF38D02BD29D4E891731E7734345AFBA582882106371EF9DBA27DA257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556493, "uuid": "ba540dda-c6e3-4dce-aef9-7326978000fd", "value": "96:JRrjleLz4IYOINpCDwk/pKI7Y/j+hA3herriwx7QkquS/:Llen4IYOsEwk/pIChA3herrvx7QkvS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645556493, "uuid": "605b4803-4462-46b5-a745-530048b7bc51", "value": 3769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645556493, "uuid": "011e3023-5a6c-4530-be41-4b62876f3b7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556493, "uuid": "ca7616fd-8587-40f7-9fa0-75de2a06ecde", "value": "EncL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4355f8-9406-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645551581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551581, "uuid": "8b73c100-a449-4255-8386-cd1e1e2babad", "comment": "Malware payload", "value": "9f94490a00598d9f31dc756732e82124", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551581, "uuid": "b5fa42e6-5aee-4f92-b6b6-e785e74ba183", "comment": "Malware payload", "value": "4af1deaa2afc385dd69b07dbf5abb4adea2437544de86deb97e79f7465d9fac7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551581, "uuid": "f59ecc41-fb9d-4f51-9f15-427c0a53c994", "comment": "Malware payload", "value": "31e4a8dfb3225e15550bdd12ff7fb5da8a2db7fd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551581, "uuid": "331382ac-2aeb-4b3c-a1a1-66ab2f672764", "comment": "Malware payload", "value": "108ab4ae42ade1e26994a85b23c085e9bb4fa15902b24682c9377912d7d07dfb552ca62be6ac536f6cac93b59460b371", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551581, "uuid": "7d2d72e5-bce8-489c-a237-f0974856fdb1", "value": "T1FD930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551581, "uuid": "ecfd04e4-21ed-4b89-89c5-e7ca1ae1209b", "value": "1536:Jyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAVkWvgrPE4nWHPNc2Al:Jyehv7q2Pjx45uoDGTj+5xtekEvi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551581, "uuid": "b1636fca-9dbe-4a2f-9045-a3b2f72e8a22", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551581, "uuid": "4cc8d99d-0c27-4ac6-89ae-f0dc7ae52603", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551581, "uuid": "a4804179-4976-4b64-844a-5ed941eee899", "value": "tmpdfcvhj5i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3becb6-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "29126d46-4cea-465a-b442-958458d2fbc3", "comment": "Malware payload (Heodo)", "value": "b3ef86a90add8e34caf5cd8aaf88a42f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "5796ad22-1674-4833-b0dd-a2a7e0ab2690", "comment": "Malware payload (Heodo)", "value": "4b184acdb10ba8eb9eb561f336e949ed25582061539663d9c3e2819a7a2b458f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "38aaa1c8-b786-480c-b90a-c7ecf9e934ac", "comment": "Malware payload (Heodo)", "value": "d78b4a4a8d3e8e41e05dca371130351a4fe1dafb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549944, "uuid": "44516f2f-3cd7-4b29-a0e1-3419fb2ecebf", "comment": "Malware payload (Heodo)", "value": "4d190e6677773d1705003726453757f7aaadf7f6c079adb0a266d955b801bfd4b645fe2309df527d735d802606e4656a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "743ae1f0-28f7-41a9-8ada-3164580c3e01", "value": "T1B0A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "d4d62b2b-7bce-4f58-a057-cea6c758ea7a", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "1220f8b2-9ccc-4fcf-b577-a446ce73fe43", "value": "12288:vicw4w2Vb0zq6k5Z2mTbjqkGXNrGHORQuBT:viSwub0W6LmTdwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549944, "uuid": "09dfa7d1-567c-41bc-aea6-f84e0a867212", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549944, "uuid": "7aa5df54-06bc-4da0-be07-928d7069cd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549944, "uuid": "96bbe2c5-3faa-4195-ab07-1cbc708b0387", "value": "emotet_exe_e4_4b184acdb10ba8eb9eb561f336e949ed25582061539663d9c3e2819a7a2b458f_2022-02-22__171218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8637732-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518265, "uuid": "d97be36f-c883-4e7d-ba7c-6588a4139dfc", "comment": "Malware payload (njrat)", "value": "08cbf3ca58a8dedcb225c7893550b731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518265, "uuid": "9f0dcbc6-69df-4b6d-920d-5c804ed2a479", "comment": "Malware payload (njrat)", "value": "4b668c23a7ceefae7f600b7f10ab915b62ed746530437efcc97701e92f6426fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518265, "uuid": "14984f24-57b7-45a1-bc4c-724d4d72f427", "comment": "Malware payload (njrat)", "value": "ab4104ced0cee00c7685ded4bcedfdc81925f440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518265, "uuid": "988f592e-f078-4eb5-a02b-b5486232fd1f", "comment": "Malware payload (njrat)", "value": "0cbe07fc1394bafcccbdb1d58463effc18a818faf6961a35f4083025f005ca88f04d346fe25e58566ee12bc68b38a45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518265, "uuid": "163a8132-1d02-4cd2-aece-eb3e888e2ea3", "value": "T1FF640FDA4CA591CCE0615E3E13B1AE05F1A3DD2CD4762650AE72B4396D3F1CA782327B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518265, "uuid": "ff7603a4-c669-493e-abcb-3734725c7b87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518265, "uuid": "d69cb3ef-7673-4622-8417-43866048f224", "value": "1536:0UzkMzK1VO+gRJNqeCGBmvfbQoD2/oTN/o25XlKMRgMpjmqy7necX7/9j+/7xaan:0U4MOy+yJEhfq/FjDcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518265, "uuid": "b36210d7-44d6-4efa-bf8e-3477090ebec0", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518265, "uuid": "b737c0b5-c44b-4355-a9fe-942e3a80c56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518265, "uuid": "7b8cf252-ce3c-4db3-8386-d62320d4f8f4", "value": "08cbf3ca58a8dedcb225c7893550b731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b710e20-940f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555314, "uuid": "cf35474f-239f-4a26-a826-f9764b57ce4d", "comment": "Malware payload", "value": "88bc0a7ca68a9687508dba2cae13d853", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555314, "uuid": "a5b4188f-9415-4673-b91e-38db1eb88b8b", "comment": "Malware payload", "value": "4b7b0d0a46bf980a15b406ef39f96da2142144b3861bd1fdf797551ea29e7e9e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555314, "uuid": "3ac9bae5-0ad5-4f81-a4cf-bd7ea456f4a3", "comment": "Malware payload", "value": "68dbe115f675daebe89c2610807d89481af581d6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555314, "uuid": "d65f54f2-567a-4c66-85f5-d0c02744cc65", "comment": "Malware payload", "value": "b1df0963e6d4f67889b32c1cb168b8dea927f5c9a47ea0aa871e2f9061f885b66efbdc039802ffb991ce4ebc19b5c7ab", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555314, "uuid": "edca6c99-4209-4b05-94f3-28b130a4f886", "value": "T1C0930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555314, "uuid": "d525e158-6041-4b24-9063-87747f77510d", "value": "1536:Fyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQxCkWvgrPE4nWHPNc2AV:Fyehv7q2Pjx45uoDGTj+5xtekEvi8/dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555314, "uuid": "4362cff4-9122-44a5-add2-0a37aab5e2b3", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555314, "uuid": "a3609d6b-feee-4fee-b64c-2aba7b7a5297", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555314, "uuid": "e14067c3-74e6-4eb4-a25f-e8621c1e35c0", "value": "tmpej46mt3z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20670d6f-93ea-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645539431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539431, "uuid": "947b1a7b-1dd6-4d88-acb0-bc9082de4f0c", "comment": "Malware payload", "value": "88a42a06623a9f33f43c01b7c130d6c3", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539431, "uuid": "01cfead5-b64a-4b98-b08f-49d6cccc28a2", "comment": "Malware payload", "value": "4c18c0a9a2a8745063073b855279f24a4cbb1986eca5535aea38d5a528de6fb5", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539431, "uuid": "500a482d-5b69-467d-b00f-9081127099f7", "comment": "Malware payload", "value": "6e545c17f5e79125ffad1028da20a861af7fbcd4", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539431, "uuid": "a57ca951-feac-43eb-9e4f-639bb6f69c40", "comment": "Malware payload", "value": "4f22de5122edc6a0910ad37d2cdcdf0405d1093dfadaa0e90758d264953cff8ab32c424bb209f8809628d31a6167b5f4", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539431, "uuid": "48e3331e-42b0-48c9-938b-efe9a2f1dfd4", "value": "T1DD122A3C4AA49EE8CF4CE1E0A97AF95600EEBE5493C0F1E2377C27A01FA67BD5114048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539431, "uuid": "8fe7780c-3b05-4b31-a290-4fee21d240a8", "value": "192:OZkoWa6Oxxdz5HkJnAgbhtXbQA8mOEDVXthbQKTQotGvaq7dl7:OZbsOxxx5HEn3hbZ8mOa1thbjQotg7dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539431, "uuid": "b37ef085-eb6b-43db-8a35-93371f369698", "value": 9340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539431, "uuid": "c7e729e3-6bf8-4809-94fe-c44003661a57", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539431, "uuid": "b72942ce-5ca0-4364-8883-5fde62db3e5b", "value": "Invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbadb9c5-93ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645541007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541007, "uuid": "cd78cce2-7180-446d-8556-7ddae3d06297", "comment": "Malware payload (Formbook)", "value": "1ce91746cf20814e38447d98be0b913b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541007, "uuid": "7ac4f80d-be64-4e53-a354-6eec312ea9eb", "comment": "Malware payload (Formbook)", "value": "4c1f15b1b8fadcb893c0263153a7f023d5316f4981c71378df9d378a3aa3f75d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541007, "uuid": "418bed7e-3870-459c-8464-a8655c7f73bf", "comment": "Malware payload (Formbook)", "value": "77ac1269ee3eb266c24c2a61cef5012e4c6f7ad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541007, "uuid": "64f5c654-c71c-4165-8cd9-a4b272574afa", "comment": "Malware payload (Formbook)", "value": "36930510b323a2438d66e093372e5d725f0ef0a9de9e755a0a29360d0f3a31767a5463830b002d4e4ea0925246350055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541007, "uuid": "fa04a4c3-6b7d-458e-b2c3-948752ab64d2", "value": "T169E44992D15045E6EC684FB2A43B0C7106977EBEFDB4B45D69ACF1752BB32D3002A90B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541007, "uuid": "db35022d-32fd-4b1a-8260-359da941ca83", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541007, "uuid": "bf59e505-0222-483f-8903-4e96ca5cad03", "value": "6144:QxDq1r3eIPeIFozrw/na8ZjZ6zHj/XhyV2mEpX/l9zETaCk+BK/EbXtnOV9LDeUc:FveIZ/WbhyzEpX/lpE+CxKcwZlIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645541007, "uuid": "567a786a-3615-42dc-b267-7187f508ab43", "value": 674847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645541007, "uuid": "f01a674c-4bbe-4b0a-b0bd-1dc7639f8178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541007, "uuid": "2ae1d231-e769-4fd8-bfe0-68596c53e5ab", "value": "HSBC Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e96dfa5-9401-11ec-9275-42010a9c0029", "comment": "Malware payload (WSHRAT)", "timestamp": 1645549280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549280, "uuid": "22b0e268-32fe-4b1f-8490-7335657d3071", "comment": "Malware payload (WSHRAT)", "value": "475b4e085ce3de59bc88d9a511e3a926", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549280, "uuid": "df5d3d10-53d0-4de8-a1e6-48a2692ad68b", "comment": "Malware payload (WSHRAT)", "value": "4c219645e26d7c9ef17b8da39fb2cb60de6b69b16dd713030f8750c6cd74b63c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549280, "uuid": "72bd4866-0659-471a-a721-1b3652ffc67d", "comment": "Malware payload (WSHRAT)", "value": "b516e7a21b0f023d5fcbda80b4540f626e3e7b39", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549280, "uuid": "15428391-a10d-4cef-8734-1ac13ced8443", "comment": "Malware payload (WSHRAT)", "value": "8e520f1ed73a65641d8c3f3e1cf270d8adfe6e618a88fcd45a3055d5933bad3644f7dc4f3d65ed2fe002a2820b48f390", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549280, "uuid": "7d1a217e-2323-4ec6-800f-ff6aab7f0f47", "value": "T15A1577D86780EC631A8D5D43BF167BE551B29273ABDC728782287BCC05E4493C6A4CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549280, "uuid": "79734f14-4e13-4e3a-9cc4-9797fc48ea5a", "value": "24576:9YeIrWr/qRigAyX/kngXFbjTLvaH28nZH19Iimg0VtxWvTbxzOObcizI/mofdEMj:YRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549280, "uuid": "e3512b6b-8ca4-4a04-b054-60053ace9b4d", "value": 887813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549280, "uuid": "c2e42380-e35f-4af7-a12a-a654f9850da4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549280, "uuid": "d34cf195-3bf2-4496-8592-33762f6d4efb", "value": "INV4874848ATT00048745.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed82737c-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518300, "uuid": "5f82cd21-c757-4cc8-b94e-1090f34a2349", "comment": "Malware payload (njrat)", "value": "8f8fa318d0cf727e42ed611d66f6c0de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518300, "uuid": "aecc8554-4bcd-430a-9e2d-8eab30dd9fd8", "comment": "Malware payload (njrat)", "value": "4c496afa11146889da1222c98a097131ef59794cae3d15907a8fae99f6ee78d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518300, "uuid": "4a673688-84ff-4663-bc22-cb31acf0db61", "comment": "Malware payload (njrat)", "value": "714cd38d5403670492acca41d08a3b3a779893bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518300, "uuid": "c2eb51bf-e4a2-457f-943b-be89a0bd8015", "comment": "Malware payload (njrat)", "value": "9445af2617787f7a2bb7ce13cdf28711cd61c71b0934cc35079759fb17ac1af430ac309843f855ed8be088f6a82de737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518300, "uuid": "99a5a026-44c4-45f1-bf9e-644d91fe3b77", "value": "T153A37CC67B94C2A4C8FC59B318A6DC0206F6AC5F8DA2E51F79E6735E12F30A1471CA53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518300, "uuid": "ef7ce3b5-fe1a-4251-ba9d-30fd5e75c3ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518300, "uuid": "982e0879-8b62-48d7-977e-dc389b011856", "value": "3072:iNtc2I+yJNM87B38vkIJUUxzqkbppqYaUo:6tciA7BzUxW0pA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518300, "uuid": "e72bea13-1412-4a34-a98c-6bd3915572b0", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518300, "uuid": "06073d07-53f4-4861-ac09-12b1e41b8a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518300, "uuid": "55061c5f-96f5-46ef-a143-054e2af096a2", "value": "8f8fa318d0cf727e42ed611d66f6c0de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889f1621-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564946, "uuid": "d531f8d5-01ee-4480-9dd2-bcc3a876046d", "comment": "Malware payload (Heodo)", "value": "c134ebc953a179defd8ce14dd028dd1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564946, "uuid": "cce62410-fdd6-4b2a-870f-17d76189e72d", "comment": "Malware payload (Heodo)", "value": "4c4a28be3d5661fb70d07b9b723c2bc399990a176420a8a8669641496a327f92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564946, "uuid": "7d31c8d6-5272-41b5-9287-dd3a5a9b70d2", "comment": "Malware payload (Heodo)", "value": "5067aa193215f8dc5efe5a242c96cc0c2b3f5baf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564946, "uuid": "55eeeeb0-24fc-4af3-a0d9-d70590e36d0a", "comment": "Malware payload (Heodo)", "value": "8c6c585a5e77a510245d6869ee6b4ad73715e410fd065b10e4558a416a40d4dcbf45edef597a2d3516a8e54ebd44955d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564946, "uuid": "ab8eba5e-f55a-4b1e-9d3b-8df1728d489c", "value": "T15EA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564946, "uuid": "ce5fcf01-09a1-4dfe-b918-024893c682d3", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564946, "uuid": "36b265c2-0c2d-4707-aae3-4947ac697175", "value": "12288:vicw4w2Vb0zq6k5Z2mTpjqkGXNrGHORQuBT:viSwub0W6LmTvwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564946, "uuid": "d5d8516f-bdb3-4f78-bdcf-5452ca29fe26", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564946, "uuid": "0ee99ecc-9163-436a-9097-adeba98557cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564946, "uuid": "79bf3123-c062-41de-afb7-8d39a7c9dead", "value": "imVNs8vro5ELmY.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82947e82-93d1-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645528858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528858, "uuid": "b2109c49-d0e0-4e1a-875b-b77aa21db125", "comment": "Malware payload (AsyncRAT)", "value": "bacdd743d3318503a7d3e4ec71d7877c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528858, "uuid": "a44941a6-a679-4e0a-b65c-34ec6c57a12c", "comment": "Malware payload (AsyncRAT)", "value": "4c4ba54bf15ca78fdfa9041f9cb19fd90814ed7b1bc99f6395e36864c3e3efbe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528858, "uuid": "b0a4c5a8-aa9d-4e92-b37a-12c7ec9c761e", "comment": "Malware payload (AsyncRAT)", "value": "1458eee229fbf46c24313c3eec01ef72507b1c25", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528858, "uuid": "0bb01a3a-b8f4-4e86-8c77-cd905804ac9d", "comment": "Malware payload (AsyncRAT)", "value": "2f30b7250967e520a9f615f065cfa2b935aedf35d1b657712f39e7dd52e2d6ce36d2c2ddbbcba27122610a537399c3ac", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528858, "uuid": "630aa006-ca9c-4f51-86cc-4c6ed85a7f84", "value": "T1E5233C003BD9812BF2BE5F74A8F2264586BAF2633603D54E1CC441DB5653FC69A429FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528858, "uuid": "2e965d08-b694-4a80-a404-0071b357a649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528858, "uuid": "928bc696-a5a4-47ce-8e78-bc6141202f00", "value": "768:cuGs1THwoPNWUtmT1MHmo2qzoGTfoMFNMy2vm9lH8PI7xCwTPIPlu0bOY/SPzqPq:cuGs1THb01m2HG/HB7xNg3bODbq9FMdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528858, "uuid": "9419ac52-17c9-4472-ace3-7020361cbe2f", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528858, "uuid": "d1423319-044d-4175-9556-ffd86ef92c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528858, "uuid": "c6d3b707-f903-4a9e-a5af-596537234f29", "value": "bacdd743d3318503a7d3e4ec71d7877c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f987eaf9-93a1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645508442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645508442, "uuid": "85c5f789-da67-421f-a419-08bb818e191a", "comment": "Malware payload (Loki)", "value": "b4b9bf6bbad9086c81a3caaa38a54fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645508442, "uuid": "72dd7e9c-c7ba-403d-91a8-e78450c6331f", "comment": "Malware payload (Loki)", "value": "4cac63d38ebc10ce7d2a3f5c7364b4c34ab3c830f083af26297e57d0ec3e7e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645508442, "uuid": "922513a4-c461-4817-8a5c-a74adc759958", "comment": "Malware payload (Loki)", "value": "1f69aedb60294bb72131ff9aec4412f04c75c04f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645508442, "uuid": "e06d7950-b116-4564-9bfc-89fd2c693ed6", "comment": "Malware payload (Loki)", "value": "7fc93c381ca286e3942f0c3126f343f6c91442c864134e214f0acdb1f61e98d556898f8235d75ae875e7fab63439c790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645508442, "uuid": "6aff0eb9-888f-484f-84dd-f5922552c6d6", "value": "T1B405BE183AA70F3CF1BA4BB649D1ECA4F7A9F7231C09F37D78506586CA52B508D42276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645508442, "uuid": "ecaa7e44-c3a5-4b76-8c9f-c20b58c4b347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645508442, "uuid": "11db43f9-15cb-465c-b10c-6c0dae879d83", "value": "12288:ogB6vPbX2LNQh7jQLI64nqwirrkrhje2b4EG34PWWDovFcimoKXF4UOtag8:UP7cNVpmqwiXigyGCWDM2yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645508442, "uuid": "107eff1a-bb4a-4ed2-b703-be884fb1192e", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645508442, "uuid": "0659bbb2-898b-4ba4-8b1c-85f492c7876b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645508442, "uuid": "79f8d09d-5510-4b49-8149-cfd41c1a73b7", "value": "Purchase Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3961c627-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517569, "uuid": "abb300dd-030b-4d92-b596-d37226af5f44", "comment": "Malware payload", "value": "771ef8648aab5df7488510cae0721ea7", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517569, "uuid": "42109508-fc69-4fb3-b8ef-d484dd958924", "comment": "Malware payload", "value": "4cc21810d786dca94e01d0714d37e3f097ff6e3813bf6e17a9bd86cd9a4ceb2b", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517569, "uuid": "66d2d5c8-a264-4077-aa7e-ad760c0f5fa3", "comment": "Malware payload", "value": "e1ccf47d2270975e864d94d658c0021417ca18ee", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517569, "uuid": "1e987f6b-ef55-4ed0-9e6d-c8b2e3e359fb", "comment": "Malware payload", "value": "4b11283ecfd04416c2f18d98c9660eb29b30a49baa3e29ccc1d73dd9f3b9d581a87be00f03769b13d90f8d896edc9909", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517569, "uuid": "cbb71f85-c429-476f-b7b1-629ac5e6adff", "value": "T1E926DFE3E0434A11DD874B7A8EA36D501E717C2DFE795A2F30887D0592F338276267A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517569, "uuid": "61541ca4-3017-4094-a1f2-e7880cb5fb6c", "value": "49152:eZpeTxrJNQGCZt1/8G2j8+qg7g35Y2ycsn7jNokoOrS0Nb:eZp6X2Zt1/8G24+qgU35Y2yXjNb/G05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517569, "uuid": "563ea88b-893d-452e-8ac2-6bbf22414438", "value": 4807758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517569, "uuid": "e4ca8dea-5652-464b-aa16-680ad213a1be", "value": "audio/x-wav", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517569, "uuid": "3b09bbf1-0831-4ec2-82b5-82a8f514f978", "value": "4cc21810d786dca94e01d0714d37e3f097ff6e3813bf6e17a9bd86cd9a4ceb2b.wav", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf5e0f5-93d1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645528822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528822, "uuid": "b0657206-c486-4165-a715-fd52576fc072", "comment": "Malware payload (RedLineStealer)", "value": "7258b88d27d528c1d522f74eeb0a15b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528822, "uuid": "ce2a6449-fbfe-4425-959e-a9f0e64bcfc2", "comment": "Malware payload (RedLineStealer)", "value": "4d18c531ac7ac2a4cd844b8db30f18571b64c13d49def3d77b6ddc7022652b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528822, "uuid": "95b3a271-ed87-45cc-89c0-8a5646710a5e", "comment": "Malware payload (RedLineStealer)", "value": "33477b54cc5792c869cfccd93f02dcde5f27d4a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528822, "uuid": "370b6765-29ce-4ead-afdf-4a1992f19c4f", "comment": "Malware payload (RedLineStealer)", "value": "e2118316dbac21366a4714ec6f86d2ef04000cf9003586d5201d8c3093c0fbd362fd03c481d78be776097be2411a62e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528822, "uuid": "67d621f7-0134-483c-8b4c-4b7844607170", "value": "T13E36333ECA853A95CC4B983073911FCBAF5474C106C6BE9FA979065C9BC73477928A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528822, "uuid": "c32d3d2f-bd83-4602-bed6-fc9839936b78", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528822, "uuid": "d9ef7a4d-d433-4bdd-9f40-c8f09b273ce8", "value": "98304:2z8sjKIaVUi1BBgln9dPIFrUBhSuo5PlFsSdVIjlQ8nLgDETH3z0:2/KzGs7gln9FIxUTggVjlQugDEjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528822, "uuid": "332af84f-c11a-494b-b665-c9db49717408", "value": 4878128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528822, "uuid": "5e36d050-0a76-45b6-b2f3-a7a4fd84d496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528822, "uuid": "628479bb-0ba4-484d-b3f1-05afc28d1ef3", "value": "flstudio_win_20.8.2.1863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5a0356-93b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645516263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516263, "uuid": "ecad39e9-09fd-445c-8c2e-127760973f84", "comment": "Malware payload (Formbook)", "value": "54401cd99c932bc502628e997f88f74c", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516263, "uuid": "fe3f3088-e6fb-44da-be57-fed4587013cc", "comment": "Malware payload (Formbook)", "value": "4dbb60b86607d40ff3b4bad35ea9fed7422397f2b6e2dab8f5bc849daec0ba09", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516263, "uuid": "aff0a967-3c44-4dd2-a637-61867156fce2", "comment": "Malware payload (Formbook)", "value": "b2d6d68ef880d6c5cabf4dd3486d580410f0f1c2", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516263, "uuid": "25d42bf3-63db-4639-b263-5f1663c012b2", "comment": "Malware payload (Formbook)", "value": "9bfea3a54bef177a89697d73c67f5f793a56be704bf66e5ea554781592cd6be586856d5a9e7b32f1b14d1a40eae44d70", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516263, "uuid": "318d35da-2b7b-4872-b48f-aadc9560c8dd", "value": "T193E4237BB9CAECF371D8930FF0D4D47DB8F000A4284D08552934665BAA52B6EBF3A459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516263, "uuid": "95adf084-85f3-4dc8-83d7-4f4f55c13804", "value": "12288:Dxzb637EvcIR8rzAVPslZFlienoJ5ABZpZFnTefr8SMigY2AXL5xi3TWWLM1RAL:DVy7qcIR8rIPyvcs65qxn6fr8FY2O5xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516263, "uuid": "42ab29e2-f1c2-42f3-bab1-c0026e9e0945", "value": 708673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516263, "uuid": "363dd325-3161-4668-a599-233416dd469a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516263, "uuid": "ebc32ad9-5791-4579-a361-87432215b8c9", "value": "Payment Advice-BG_EDG9502022020401200015_2725_950.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963e1ffc-937c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645492384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492384, "uuid": "2a546795-6796-40b4-993d-1b0d53834db7", "comment": "Malware payload (AgentTesla)", "value": "2783c5184958b0d13f018246b38c9ac9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492384, "uuid": "ce83447e-f416-496b-834e-684239518f0e", "comment": "Malware payload (AgentTesla)", "value": "4dc51152a636480a67ca9b50488d59800fc9a6b65afc7bfe3ae60576835a1ce6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492384, "uuid": "082a3bae-36bc-4e4b-9d79-988d0788a5b5", "comment": "Malware payload (AgentTesla)", "value": "598490e031336eed973624f8a74f9e5390581be4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492384, "uuid": "06bb8583-faf3-4b7b-9d96-c0259ed83694", "comment": "Malware payload (AgentTesla)", "value": "ee5e9a487c1d5cb7c8247211eeac0cd84cccadee6bb492de473f1eaef928572053d79f906b0a92314987a10ada0a8fe0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492384, "uuid": "f48938e6-217d-40d3-9746-900a08eed9b5", "value": "T12075F18C6DB640FBD7368A7D8DECE861BAF8B5123704F67975C61B05037069E48D322A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492384, "uuid": "e137cf57-91ae-485f-97dc-6e4b57445601", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492384, "uuid": "488923f7-eb27-4dd0-8043-4c04f2527b1c", "value": "24576:UbHchF631MVVmaWzNIT4rdvEbipP4fgdX0wRstmeb2bU/5aOMLTHcSUf:UbHchc1MV2pI0rdjBvdXxsDSbRO0Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492384, "uuid": "9238aefd-82fa-4463-8011-db32d1dd0b59", "value": 1678336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492384, "uuid": "f6218e6a-0598-4527-a398-39d66571b4f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492384, "uuid": "c10a1157-010a-4ae1-8004-453ac370f53f", "value": "samples.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dfc904-93a0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645507634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507634, "uuid": "17d292b4-a2d9-4f6b-9d7a-7ef273d41e0c", "comment": "Malware payload (AgentTesla)", "value": "4a3c915eec7e00014555c1f44f53360b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507634, "uuid": "92d737b4-80f8-4d2b-bd38-0f589b608472", "comment": "Malware payload (AgentTesla)", "value": "4e2d44597e791e4e2177434ffe411b22557d005eb940cca7e7ad62b055d1cac5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507634, "uuid": "2253ff8e-0a76-46ba-aa19-3b6085fee879", "comment": "Malware payload (AgentTesla)", "value": "e332a559a17bc9e563595f5c6fe5c2c3e1317d2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507634, "uuid": "84be5119-965b-4822-97df-3537270be20a", "comment": "Malware payload (AgentTesla)", "value": "6e859b0f2d7481e7cd68249a1256596ca31a39a0717c1cd0a1870fc4f8ff4d98b22a9f4ffd228cdc8d8c5dd4a1732fef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507634, "uuid": "a834df57-a29b-4133-aa11-7bc5b8e56ff4", "value": "T1AE15CF042AAB0F3DF0BA4BB648C1EC74F7A9F6235D19F37D7D412596CA52B108D422B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507634, "uuid": "551b7078-7c4f-4cb0-9ea8-cbc1a7c128d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507634, "uuid": "36b408c6-0d44-482c-a7ff-c602ba305cb5", "value": "12288:egB6PeN1ah7jZcARpL/snIbx/Dj6PC/h5urnJWQRBWtf6bi+rU7tfkw/CEd:SeNa/sIbpC6Z4VjRBUAi+y8Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645507634, "uuid": "39a5d2da-e515-446e-acfa-0794f1ec435a", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645507634, "uuid": "5d7dfacc-fad9-431d-9704-c34f720fc0f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507634, "uuid": "c46d27d7-d932-4356-9291-fe415b0d9275", "value": "Quote 571094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24fa855-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645513933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513933, "uuid": "699706f8-c8df-458a-a1d6-c4dd3173f750", "comment": "Malware payload (SnakeKeylogger)", "value": "ee872e2f52e9bf967382106da591bc63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513933, "uuid": "e83ff6d8-8585-4e56-95e9-2c995774803e", "comment": "Malware payload (SnakeKeylogger)", "value": "4ebe31c1709a26474c5344c307129ada401b4d0a5ff5ebfcd3e43c05d643a7cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513933, "uuid": "4c289913-55dc-40f3-bb31-babfa6647120", "comment": "Malware payload (SnakeKeylogger)", "value": "3f3be44ff2921797331a063ed6d5500f653158ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513933, "uuid": "b80da00a-6025-4fa1-8b73-5adbc1d8f424", "comment": "Malware payload (SnakeKeylogger)", "value": "c4a3be5cc1060d2d85c8e5b2c17ce384dec5252bdc39ed3cb80b97fb5bb8408ea3a001f294379d78a6a1ef06254d62a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513933, "uuid": "499c2021-aa23-4d05-8b4e-61365aedfb88", "value": "T1B6E438A102857EEBC5FC10BC66302810A2FACE522156DF8D3DE170E6D6D3A46A73775E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513933, "uuid": "07fdb02e-622c-4177-865a-eee62983c617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513933, "uuid": "de9e957e-0dda-4708-adc7-e8abac3ac68c", "value": "12288:1FILZVox2YdGvnM32TLw/GQBLIMPl/G+8VKOaFA8Z0ZiugBNn+6Gbm:KOb0vn/TwNNI4JGJQI8mYBEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513933, "uuid": "f646eb45-31c7-4fc5-88d7-34358afd334b", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513933, "uuid": "f2b2e6f8-6ea4-4455-a9c0-9bb87afad80c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513933, "uuid": "49d6d012-cbed-4c8e-9714-6a782607ad44", "value": "Order List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec710557-93da-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645532902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532902, "uuid": "c797f945-d44d-4bc1-b953-884386e61274", "comment": "Malware payload (AgentTesla)", "value": "7a9270863fc4cd0ba1f807568ff5ca56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532902, "uuid": "3b7c431e-b7bd-4c1e-82f6-b92fa2a24c16", "comment": "Malware payload (AgentTesla)", "value": "4ef086ee8684867e9ee8015ed56fcb00acca1057153cede0c33e23c8d974e819", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532902, "uuid": "1238e579-df14-470c-8b0b-dc2da226b474", "comment": "Malware payload (AgentTesla)", "value": "331558d633a7b621ed61fec9f9de760d2d3faf36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532902, "uuid": "cec8d4e7-f7e7-41d3-a39b-d4c6c50d435b", "comment": "Malware payload (AgentTesla)", "value": "6562655e0b656d9628fbfbae2633ea6cd39c96c6a2f473caf2cb882ff21f6cdeccd4021f84d137d605a8133993e59d4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532902, "uuid": "270a164c-3506-4994-8eb8-2fa5a43d0d25", "value": "T1A2355B9C365072EFC897C976CAA81C64EA60747B930FD203A05312ADDE4DA9BDF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532902, "uuid": "9d69ce32-1574-4f2f-a8e2-128dcfa610ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532902, "uuid": "b79e9eb3-588b-4f10-8a5a-98cbb9b6a09d", "value": "12288:vPtH70FEwB3RUNuGnBUBYCfjqFvfM4JtSIVTFSXYFE4YmcX9XyfTxRsaB0kuPJ+D:vPtH70HB3uNuGnBm3f2gAX2RmQ9gx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532902, "uuid": "a1f387b7-1722-4c59-aeae-195739473224", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532902, "uuid": "2250f695-e976-4d24-a776-18709a3186cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532902, "uuid": "c96dbb30-c6f1-4ed6-aaf9-e2ebc95c3300", "value": "Copy of Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae8e5cb-9427-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565809, "uuid": "16187514-e51b-410c-b5f6-8821b6290add", "comment": "Malware payload (Heodo)", "value": "07ed36c2c079d28087d946f23b8c3893", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565809, "uuid": "336a4e29-4f57-4098-9d1f-fb5747e0f0ea", "comment": "Malware payload (Heodo)", "value": "4f077d83eb637b108992443a6d9d3d4c5b0da8ac37884e2e7791fb9bb08acdea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565809, "uuid": "d8462fcf-eb15-4f4f-868f-c0989d179be1", "comment": "Malware payload (Heodo)", "value": "745c5e074a31627f119e740193af2bd847f83a62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565809, "uuid": "9e6e1cf9-0bd5-4d60-8679-8b295f862083", "comment": "Malware payload (Heodo)", "value": "52e11551c43ce8896a271e0ba5d4bfd7445789d8326d8b6925ba69f687c2950b532af931060186d676a7ae01f6679ec0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565809, "uuid": "c7ff8744-2601-4e62-bfcc-a146b40555ff", "value": "T1D3B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565809, "uuid": "461011f2-5e16-4fc5-842d-408ce94c4a67", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565809, "uuid": "b26546f3-8a53-455c-8019-2a2684ee2279", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wiIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWdzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565809, "uuid": "130030f2-7e65-4b32-a6e2-0f36a344b9ba", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565809, "uuid": "1ea90eed-ec8e-4fd4-a975-3ffd2beae701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565809, "uuid": "3c35ba8b-4404-4961-93a9-4130d4a164e7", "value": "07ed36c2c079d28087d946f23b8c3893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811cdabd-9403-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645550331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550331, "uuid": "7f0a5f08-f3ae-4c65-bb50-589b4ef30681", "comment": "Malware payload", "value": "b921815594f31a7b4e52070ce11b1425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550331, "uuid": "e62b41f9-0097-4720-956d-f77e3b9f2728", "comment": "Malware payload", "value": "4faf362b3fe403975938e27195959871523689d0bf7fba757ddfa7d00d437fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550331, "uuid": "89303681-f587-419b-9528-6bcb2e10a4af", "comment": "Malware payload", "value": "db6e1a1dbb0e351c44b49db79b8bad3321d673a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550331, "uuid": "1f1a5c18-7974-442b-b17d-4c62b228f430", "comment": "Malware payload", "value": "32b2ecf3dfd2c1f5906c8498b5320dc0bca66a43ae50ab773627d012793e855a942ebd915e335acfe446073b6229e33e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550331, "uuid": "26b48052-2f45-4f33-b2c5-51cb07e2c722", "value": "T10AF4B002D2E511E9F1BBE579CA66C326EFB174295B709FCF026085992E13FE0993E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550331, "uuid": "5a0247e1-e89d-426b-8498-54c6a87bfd67", "value": "8f0e5dd8864ff466a5fb05c68b7d35f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550331, "uuid": "0f7f19d0-dd30-49e6-b9ef-094abdbbcb90", "value": "12288:K6r8nL5ek3xyH9s9MicEuAwrinAPf7YWsjwZjWgqHH1nHzaYBnIUtJ+:K6r8nddmPinAn7rsjwZjWgqnVP1X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550331, "uuid": "578fc1e8-eb4c-4301-b78b-049fe6713fba", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550331, "uuid": "490de3f9-5a02-4d28-8f5d-05dd7d54f2d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550331, "uuid": "6ddeb07d-4afe-4299-b47c-7bdf6d79b2a1", "value": "wimgapi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921a8978-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645514282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514282, "uuid": "c244d975-7b04-492b-9829-31239fb39faf", "comment": "Malware payload (Loki)", "value": "6d70b1d626b6e860aabbdba62f877ab1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514282, "uuid": "730ecffc-47a3-4245-867a-16cd2b6787bc", "comment": "Malware payload (Loki)", "value": "4fd8997666cafab4e20d7c718b06a040b4c4cac803bd8ce1f1c6c3352685d612", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514282, "uuid": "bdb059dd-973d-482a-89df-638aa5ed0b08", "comment": "Malware payload (Loki)", "value": "8f161a385d381094e34b52809c039a2ee033d1a9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514282, "uuid": "6c61f57b-194c-44ec-848f-739e3e214194", "comment": "Malware payload (Loki)", "value": "babdb6d8cca8db0c26099f4a10c22629c7ae2623db35935e494aff35cecc5da0f18e187f606aa15ea5039316a454bfc9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514282, "uuid": "dbdecb3f-26d8-43b8-97d4-da0747933a15", "value": "T1F0141201B267ABEDE26D95375FAA282153A4DD9FC80D3760E57C325871F42C3B820FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514282, "uuid": "c6ef19fc-0215-40aa-a0f8-3a4656cef69c", "value": "3072:Icwp6ZOC7Wfh3CcQv9Zm6CuP9EqSgX0TR6UI2OEVDcGmcgmIrhMK8Km4kTX:lwpFFfOvE9486udVDcPcgVCK8KCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514282, "uuid": "4dd0908c-5c98-4f66-8a64-4e179506dda7", "value": 190744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514282, "uuid": "7a2c627b-8a8d-485f-b4f6-9300288bb02f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514282, "uuid": "0d862458-cc98-4774-b5a8-f35f33b42fd2", "value": "PO 21P6201052.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2022a9bc-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1645518385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518385, "uuid": "edf29905-f93e-4810-b9aa-4c8740adb483", "comment": "Malware payload (AZORult)", "value": "618c416de4a5462a2b4b1be9571193ce", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518385, "uuid": "c7fb496f-2e13-4739-8b55-7fcf8b45ae3e", "comment": "Malware payload (AZORult)", "value": "502f86e2e673029e2141d54c6f08a6ec8b4e6dc6ae7419f5a985c77996da8493", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518385, "uuid": "12e6c145-2c77-42d4-8f9d-d53c9e77a5cf", "comment": "Malware payload (AZORult)", "value": "9c20f4cce7b93db892c9aaa3d13022534fd5dd1f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518385, "uuid": "0d818017-a5c7-40d2-aabb-139806761e9a", "comment": "Malware payload (AZORult)", "value": "4986773b477df604896689b0c792c3c928624d59a84e33992e1d6d8b10b4b52ce527c96edaebe408a94ca1f5d175a483", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518385, "uuid": "62f2f1b2-eb9e-41b1-a27b-90b2d09a39a0", "value": "T17905CF142AA74F3DF1B94BB659C0EC64F769F3235C09F37E7940269ACA52B408D422B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518385, "uuid": "f3a7a3c9-8a97-4533-969f-448f49054820", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518385, "uuid": "0b1bb8ac-db94-42e6-9d6d-07f5b627bc3b", "value": "12288:3gB6vAcENRh7jW8HrMvT00hVMObsyBaBdnTvbbXcPvY8h0uo804FJzCKU9sW6:LAPNmdtMOsyBaBdnjbbMYGRN0UCKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518385, "uuid": "f713406d-fd99-4ce3-b8c0-dadc2f3ce2c8", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518385, "uuid": "3ef5e702-a692-4cd6-96b3-33d669dd3d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518385, "uuid": "93a4a2d4-6d23-40b7-a625-06c4ea6e1b6f", "value": "618c416de4a5462a2b4b1be9571193ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c295b3e8-9388-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1645497613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645497613, "uuid": "81e78662-4c83-447e-96c1-f2a5f93b443b", "comment": "Malware payload (NetWire)", "value": "4e5d655efdcea8ffc607632568bc4a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645497613, "uuid": "2bddd2a3-aea7-4b03-995d-9abeca9e871d", "comment": "Malware payload (NetWire)", "value": "50a95734e8a83b187ac1804a2dc2ae3a9e64fddde06b370454f26d7b9d7ffadc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645497613, "uuid": "bacb0e92-2a95-432d-9d17-b7fc0d65d43a", "comment": "Malware payload (NetWire)", "value": "e7fec202dba337085773f697cb01b5d79646e5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645497613, "uuid": "2b996049-037e-4d54-a8a9-edcbc72b56d3", "comment": "Malware payload (NetWire)", "value": "ce839d53ae2aa76fd0ac1ef442c7d8ac816e642bda344139affbdb079eb6da73aa7b7de78effde9d4520bb25f57466cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645497613, "uuid": "4c50ff3b-3d4d-4dbf-a7f2-91c4248f975b", "value": "T1A0E2F82162BC02F4FADCCDB06E15D37906659C4188728265E4CB3DC6F937A13CB66AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645497613, "uuid": "de73b635-83fb-4f48-af98-6a6782661a8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645497613, "uuid": "354dabd5-d998-47d5-ad46-1dd69b003d95", "value": "384:dJdBFItbkC+wgDYfOl7rsIzll0zJJnGzMgKKsMVqJfmv:dJab6gFIzll0zJJnGzMgZqJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645497613, "uuid": "5bdc709d-90e2-4fb6-bb78-e32d10185990", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645497613, "uuid": "6b3afa39-76ba-420c-b112-f867bb75a78a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645497613, "uuid": "329a7f21-2069-4af0-8de8-162f64ef7432", "value": "PL1041000058xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7b21ff-942e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645569011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645569011, "uuid": "78343bc2-d16b-4ed5-aa33-22de0b1a9547", "comment": "Malware payload (Heodo)", "value": "50bb1a824039c62c041d0d698473033a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645569011, "uuid": "5b16f550-f047-4440-b72a-8eb7078001a1", "comment": "Malware payload (Heodo)", "value": "51259dec600a98e5f8af4cff1418625014c2e807ccda0e1d1233c52c970e90f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645569011, "uuid": "3213b7df-de12-499f-9080-3b9a7fe99605", "comment": "Malware payload (Heodo)", "value": "9082cb420c64b4a04d046091e10c55ab52d08423", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645569011, "uuid": "6dfc0161-e232-4845-b033-b6a3843da9ac", "comment": "Malware payload (Heodo)", "value": "ec4fea7ac105f6d9873abbf0361e41304fc7f34d88e608f71e937e39e7a9c5d046637ad5f40da0377a0752ff56b2ee5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645569011, "uuid": "698ec0f3-e7de-4da2-b068-457e2d3c7126", "value": "T18AB42902A612F13DC28FA0754D016A65D0AEC8E5277177E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645569011, "uuid": "0ff2c24e-e3e0-472c-aec1-4d2b9a85a6bb", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645569011, "uuid": "08d0ea22-2ceb-46b1-9c16-1f0b64e9f1f5", "value": "12288:IOzyEtBX2ZHq79+a6/G5YgvmgZDa6A9TU:lnmZKR+KYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645569011, "uuid": "c6320f77-e552-435b-b5fc-01a5d1255819", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645569011, "uuid": "2ee30fad-f222-48af-a7a0-8986a8b864d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645569011, "uuid": "7fd413cc-f325-4c68-9e93-4dd727bd3a47", "value": "50bb1a824039c62c041d0d698473033a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66381234-9406-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645551574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551574, "uuid": "a87f8df2-68ba-4b55-91f5-838a3d10f963", "comment": "Malware payload", "value": "694a28d0cb058a56cc5471ae316bca9c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551574, "uuid": "20546ef7-f9a2-4158-81be-ca92ba850d93", "comment": "Malware payload", "value": "5162384c94c1e4bca89f942224fee8f71a323f2554a906a0b44830e8fc64b6e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551574, "uuid": "a6804c06-90e9-4ec8-b097-508df60125de", "comment": "Malware payload", "value": "22390bc5d594597f2531787c168340962672fb5e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551574, "uuid": "535b7ce1-eff9-4338-8312-2dc83dfe1135", "comment": "Malware payload", "value": "b836c15cd5c85861fe7a9079785f91744e187247e88aec666d2265fe713d5e6875bbe98e9cbe156b8e741fae2c94328a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551574, "uuid": "4158666d-c4a0-4f24-b0cb-387ebdcae590", "value": "T1BA930769B685C95BCA5807344CD7CBF67227BC424E7983473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551574, "uuid": "d1d19961-753b-4f7f-a5df-5213e46f507a", "value": "1536:Lyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAakWvgrPE4nWHPNc2Ap:Lyehv7q2Pjx45uoDGTj+5xtekEvi8/dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551574, "uuid": "690abc5b-9a37-40f1-aa39-bfd8c37ded8f", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551574, "uuid": "88747a1b-2243-4c6f-b23a-6e38249814df", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551574, "uuid": "57da29e4-f39e-42c2-9d27-e19cbcea017a", "value": "tmp9vds9ad1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e79c926-93da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645532637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532637, "uuid": "87fa902c-34e7-4c00-8ba2-b3ac73704037", "comment": "Malware payload", "value": "3ca032ebfa29d44d2ca234ad419682da", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532637, "uuid": "ef0aaa51-cb2c-4925-ae51-190e24e9fc00", "comment": "Malware payload", "value": "516bdc129b8d08dfabf6bb3fa2883fcb45aa431efb742eab9029b231923c5dc8", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532637, "uuid": "4c07bb06-bb59-4776-b3c4-58467e2ebe68", "comment": "Malware payload", "value": "e0d0dbda10d682fa664a993e4115c5ee7d4f46b5", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532637, "uuid": "2ba93fae-2a9e-4329-b6eb-136ded294502", "comment": "Malware payload", "value": "fdbef36035a8c178ac869f0166f399af91bbfb0dd7eacc68073ffa12ee0d7bdfae1aa381cdc6ce6e9ccaf2ae9b711dd8", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532637, "uuid": "03d5d836-0296-4b9f-b987-02b973764924", "value": "T10F412A315918A450C25F41FD229712E8038982609C6746FA3E8F0CC69C2950F37FA167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532637, "uuid": "33669b1c-e4f8-4172-9a4b-e68f024bc795", "value": "48:9W4XwT8EdfmENTem09BhSonUiPfEzk9frmTmoAZaMT:lgTNdmENTZ0ThfEzWT6UaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532637, "uuid": "74a1a2b6-f41d-4a79-9a8b-dbd8168dadf9", "value": 1903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532637, "uuid": "27f8bf9e-ecb4-41aa-a821-6fd2b9b56502", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532637, "uuid": "11f2145e-1350-4411-b899-fbd07c846344", "value": "documentaz_509.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf99f2b2-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492051, "uuid": "ffd98383-c2ce-4280-9461-13f68b278bec", "comment": "Malware payload (Mirai)", "value": "f6fea095288ad9a071af5ea543c29a3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492051, "uuid": "4c451f99-b16b-4e8a-846f-f76b82795c41", "comment": "Malware payload (Mirai)", "value": "524b1cef83d659496b366c45592462e08f19a40ebed3a5eb638cee19072a0b22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492051, "uuid": "abf24bdb-89af-4cb9-8437-677d98c5110b", "comment": "Malware payload (Mirai)", "value": "cc00c25a5006c626d580bfe0c6903694d229023a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492051, "uuid": "edb430bb-ff0b-4683-9fdf-1bbede390578", "comment": "Malware payload (Mirai)", "value": "c0aee4720888767a52d59124000c7f5723dcdff115f09ae38eae3a16fd29bca59d07ea968e93acb2e986379825251a52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492051, "uuid": "675b4eba-2295-4c41-acf6-65bb24d10268", "value": "T1F2E2E160A1612CD2DBA45D7F2EAD814236BB5FF4D1C624B6296190709EE32835B22D1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492051, "uuid": "c4a865b4-90b6-439e-8dc0-06bc61e6b8bb", "value": "768:WGQxOyNPBxmuAigaXN6HuUzioEfnZfibwSyoSXI3Uu:WbkkAhEwOaioyIbwZoaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492051, "uuid": "ee09a3f2-f153-4b6b-9990-73305d0cd405", "value": 33672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492051, "uuid": "3e0f059e-d2a8-4ad4-ba4e-fce6006a02bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492051, "uuid": "5db7c3f2-4663-4f47-9a1a-bbea70f3c21f", "value": "f6fea095288ad9a071af5ea543c29a3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1108bc24-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload (FormBook)", "timestamp": 1645518360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518360, "uuid": "708691b2-eb95-4684-a386-5ad90f80fc91", "comment": "Malware payload (FormBook)", "value": "10c677b0ca6aa171094f41c826a330f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518360, "uuid": "99ff682b-49e7-4d5c-9ed6-042e2f820eb0", "comment": "Malware payload (FormBook)", "value": "5289d529e7d53da3449ddf8400d12ae7622ede25284c2823ed46d0800fd94736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518360, "uuid": "2dcd6416-23f6-4c54-8972-a0b5a432464d", "comment": "Malware payload (FormBook)", "value": "2b0f37fb9b15f5080504faa73977e15d1055cd52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518360, "uuid": "c90475db-7149-4e47-b289-af2affeb187c", "comment": "Malware payload (FormBook)", "value": "47746b239eb50870ac41c1b57c2f738efa2a7e1927860492caac7be91daa5779502ff5341a7d9845b0e0bb5caa4da23e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518360, "uuid": "278b1169-02a7-4e3a-94a4-1e530add1ad3", "value": "T1D1F4AE37F6A04932C1237A758C0B87B45915FDB03DE5AD8926D9BE8C6E363813A391C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518360, "uuid": "040d0d0f-426a-4175-b8a7-469417715a85", "value": "a2b1f9362995bc28a36605fbc99d4e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518360, "uuid": "fd3af3d5-e8d5-408c-9a6f-1b374f97b7b1", "value": "12288:+MWizRWp2IAj8Ol9NqAt0tIKHOUh6hK+DOGPzYPcThJ:jb0p2IYxl9NJtv8YhLCoEP+hJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518360, "uuid": "f77c0b50-7245-4583-8373-b60672e1f8da", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518360, "uuid": "60142d07-9524-49fb-badd-821b6b1bea7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518360, "uuid": "bea1d407-4fa9-4877-aadd-467974925265", "value": "10c677b0ca6aa171094f41c826a330f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8a073b-9412-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645556821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556821, "uuid": "512b73a4-d7b1-4677-b366-e42ff10981c4", "comment": "Malware payload (Formbook)", "value": "91a8a1a7ddbd3c26bb6dc56793618c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556821, "uuid": "67edc785-e0f9-4f5c-9142-89ac392a761e", "comment": "Malware payload (Formbook)", "value": "5309e266c7312aa2582ceb5f8a6e74d1560cbb1f899822b29dd4008d736cf503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556821, "uuid": "4d8da4c7-51ae-452f-826c-561a9cff3cff", "comment": "Malware payload (Formbook)", "value": "edb5bed0970418875cb321e34559430f2cbabb7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556821, "uuid": "a18cd8f5-d380-42ba-8f91-14853efa2508", "comment": "Malware payload (Formbook)", "value": "815cd8337b44c3d2f543cbfaa09e71479f3444fb75149d9b9ff779ed27d341dd60eabca2d9824175c37c9f646fe35ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556821, "uuid": "4ea43449-7207-44d8-aa7c-66cc919b73e5", "value": "T11C354A9C365072EFC85BC972CAA81C64EA60747B931BD243A05712EDDE0DA9BDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556821, "uuid": "3941e31e-1d13-4c1c-ab79-d462be3f24f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556821, "uuid": "19ff8599-fa33-4ec0-9185-ee101cf8d8e0", "value": "24576:Jvjd6/mcgeraL23mmYFrBrk7Uvx1+tCMNlCkDr3:JvBK7gb23mmYlBWUZ1EpDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645556821, "uuid": "01ddfd7f-ab4f-45f4-b990-e5d86abdb8c5", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645556821, "uuid": "8ee7c401-b7c5-4101-8fdc-889d96e151ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556821, "uuid": "071fc06e-cfca-45c9-b13c-3883ed34106e", "value": "NUEVA ORDEN DE COMPRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821d432c-941f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645562358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562358, "uuid": "03be0418-9874-42bc-bbc7-4be600397e56", "comment": "Malware payload (Heodo)", "value": "7482fb5bfadecaa0de92a029d5b325f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562358, "uuid": "0c0952c1-bd8c-4447-9807-ecbb773ec579", "comment": "Malware payload (Heodo)", "value": "532612ba902ea2169f8b129f73ad1f155f4ab2a6bf4fa7467fd1d9fc82b5697d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562358, "uuid": "3af86d3c-d821-4f68-86d0-1d06cfd87148", "comment": "Malware payload (Heodo)", "value": "b28d230da2ebccb7fa484e7b5fa0bc13b2cc2e2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562358, "uuid": "5388c50b-b7d8-4fbb-bef9-6ed50ba0257e", "comment": "Malware payload (Heodo)", "value": "15f20a4ebf4982dbe3ef850ae2c002a6e0c0602bb870aa3fb4b72eb2b6f860529682d7afeeae691790e23adb7b5b2c36", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562358, "uuid": "77071f22-5268-4219-baec-4076071281b3", "value": "T1D0A4AD21B7D0D032C2AE31746A16E3B56AADB93099F592477FC40B7D9F351D28A2834F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562358, "uuid": "924dfbdc-73b0-4784-ada9-8ce98ed5da83", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562358, "uuid": "e92b6b8e-8b6a-4046-b27c-7ba93048f5e3", "value": "6144:PFdhYCryBe9NY/55YWAVtXWUVPlLX8IjMpz5yRsSIpqAiA8KQd5dhMYi7nwZJjIF:dPY8Y/7nctXWUDIpz5GsxH2fTSRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562358, "uuid": "274e91ed-e824-438e-893e-ecf30b295c49", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562358, "uuid": "dac34270-75ea-450c-8f01-4d7aeedd565a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562358, "uuid": "85624133-623c-4d28-8fb8-a7037cd889e5", "value": "emotet_exe_e5_532612ba902ea2169f8b129f73ad1f155f4ab2a6bf4fa7467fd1d9fc82b5697d_2022-02-22__203914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fa864d-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645531869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531869, "uuid": "dabaec9e-d9e9-4dcb-94f8-38c40787a0f8", "comment": "Malware payload (SnakeKeylogger)", "value": "8704b80175cb258c0df3c915ec19e882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531869, "uuid": "8cf9fa87-be64-4b84-b6e7-a79e0623039a", "comment": "Malware payload (SnakeKeylogger)", "value": "532c1adc08f46f8c30a9e787fd6c59350c94966b5eb8b7549d32e2e0af7600e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531869, "uuid": "8b3f354b-1f94-40ee-9028-92dbff74ce18", "comment": "Malware payload (SnakeKeylogger)", "value": "7af4231eba8721346d3818ee453365c1662e2156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531869, "uuid": "37eac329-0324-4aa2-ab7f-321d6d8cd6c8", "comment": "Malware payload (SnakeKeylogger)", "value": "ec85735e989349241cfcb8166da3d6cbf725e874d73bf8ed5c538c8eabc5fb1543ff9d3e753264079df9ee28ceeee6ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531869, "uuid": "16593b7a-2670-4e8e-9b99-1de3bc45a199", "value": "T137D2B37093A9EA31DA54393A9A566B08333CDE018CD7CB23795C7F1F9D2224096737E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531869, "uuid": "c53a510a-6e0d-4314-872f-f050a6629116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531869, "uuid": "200bbca2-d051-4f0d-b9eb-f0db4beafbc6", "value": "768:CA6oTbOtQps4nMWp/jI4XuMI/86nOa6TPd:JJbOssL6o186OaCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531869, "uuid": "d34ea1d6-69ef-4a54-b04d-0cf2a2518156", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531869, "uuid": "5ff1f966-0c5a-476b-9a2a-46ea845920d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531869, "uuid": "3588b28c-f8f8-4c0a-bbbd-1d8e73c094fd", "value": "Payment Advice swift mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec2645d-93fb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645546703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546703, "uuid": "34d26b44-0e53-44bc-887a-482be4673a3a", "comment": "Malware payload", "value": "07cad9b0c9bdbf1ff25e3d18d9e2b068", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546703, "uuid": "ee3b2dfa-eaad-479e-80d6-f889ffc4ba54", "comment": "Malware payload", "value": "53e615f0afc444f5bcb472e3d23e175e028a0a0b27661579d205051be0cbd04f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546703, "uuid": "355608d3-1c1b-46d3-92ed-fb73d1b19f74", "comment": "Malware payload", "value": "6133cf19f2c573f1fd07afbeb8fc56e0b4d9bc35", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546703, "uuid": "120c7aa0-4e17-4811-a5f6-723236c87b2a", "comment": "Malware payload", "value": "0aa7763dc303e19331835e53568ea12b3877f04b555e78f13cae091191968dcf09c4f216b9375a71323222641fe0bb64", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546703, "uuid": "ee43d5cc-7a3d-4292-9d01-f4375feddd3c", "value": "T10BF272A2B3D5E80AD99A077A4CE7C7E66627FC615F53834B3285F70E1F71A808903617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546703, "uuid": "d780fe0b-ef5b-4f09-9dda-7cb9d2a234c4", "value": "768:Vqmk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJUWgLQNs+Ze23D+YKx:Bk3hOdsylKlgxopeiBNhZFGzE+cL2kdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546703, "uuid": "393c5443-0dc8-4f41-973d-2f4a088d5b6c", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546703, "uuid": "849950f5-3aa0-41f1-98ff-401bc6dfef6d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546703, "uuid": "aace715f-f425-48d7-9e81-937e69a29257", "value": "ACH Remittance.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd95d87d-93ec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645540554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540554, "uuid": "e907b19e-4a5d-4b96-8e80-a50ee0367a29", "comment": "Malware payload", "value": "b4dcb52e46cfc0ed7deb25ff72bdf521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540554, "uuid": "2b7dfe8d-a1e5-43e9-b2ea-9591980a5eea", "comment": "Malware payload", "value": "541575054a7c0b48bc364444ed5402426dd934f777f05e8e22fabe302a190e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540554, "uuid": "1c01f36a-2cf0-449d-a015-7d4cc2f3c1f7", "comment": "Malware payload", "value": "1d4b8fd6bd5d9985c5fc3936f8d2d4986292647c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540554, "uuid": "f75fdb43-9f71-4797-92f7-34fa785ec04e", "comment": "Malware payload", "value": "7c8eb80e3b4d55f78b5339c3beabbe0be86ff49fe5c8557dae25d0a9ab99a7b3d527855af107a5f0832212cd677f57cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540554, "uuid": "6ff89eb8-1bcc-4977-a449-1dd243b17113", "value": "T103646B5AB7A514B8E177813CC9639546E7F27C120771DBEF13A0861A2F37BD0993AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540554, "uuid": "9ace797b-dc6b-497f-b134-156742c2b0e2", "value": "14ed37f9651e3f88700ab13197cfcfe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540554, "uuid": "c2289f8d-572b-453e-985d-c86ca7624ff3", "value": "6144:IfDqlSIxKCTuQOJTJBQwfmN/6bW0zxalVVelohGOCjJ3:8DBIxKC6lHmN/BfEoxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645540554, "uuid": "b1afb621-c275-40c8-a504-f4953164c70d", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645540554, "uuid": "7930316e-b792-4b1c-b133-cf0b2c3809fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540554, "uuid": "85ca267d-99ef-4bf9-b7df-fadacdce2e4e", "value": "cvjsgh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea9f5d4-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554112, "uuid": "84420574-6b4f-4a2e-b91b-e6ee0d97570d", "comment": "Malware payload", "value": "b416a588040b14be9b521972d2ec60e0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554112, "uuid": "c30ceff2-4ded-462e-ae8d-57035ecf4adf", "comment": "Malware payload", "value": "551fbcc605c95f61002c306fa06be1fbb9e014aa228d55a4132267080e143560", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554112, "uuid": "18c1e0a0-d453-4a28-ab90-132c65be2d64", "comment": "Malware payload", "value": "3135813dec49640d678031280d109ac08cbcbae6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554112, "uuid": "a02c96cf-1a45-4ee2-8df4-abd12c7b9462", "comment": "Malware payload", "value": "a2a61f6b4d256e1bb920a130071b33bca532e686864ac4a7404b999b9022c2089a6ad1144aa9b72e007480b395751c06", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554112, "uuid": "412a0106-c716-465c-8b87-b748c9d05c1d", "value": "T11153F239D24FBE9CC13ECC7C92AD28F9AD4CA495C708B3EA394AC45E164285F42415DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554112, "uuid": "e4692ce1-a6ad-4091-949a-f6f4ad5a0e09", "value": "1536:NSHiI5F/1pwZpNaG13zKCnCrlKH0CwRfftqZ:ExTp6bVOpf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554112, "uuid": "8fd7f2bb-5813-447b-aebb-1705d8bf240e", "value": 61043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554112, "uuid": "1f1a69a6-ee96-48e8-9f7f-f14bb6c8e983", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554112, "uuid": "2fbd9d39-e2c8-4db6-ba26-7bd5e38db4c0", "value": "tmpxryjhabv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83683dbd-9427-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565797, "uuid": "62e0b9c8-586d-472e-9bc1-d92ae64de954", "comment": "Malware payload (Heodo)", "value": "a4306ae5e75e4d0a8599ae04e8d5c4ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565797, "uuid": "5042e832-a4f8-4492-8e48-0e057c7cf8b5", "comment": "Malware payload (Heodo)", "value": "56474e92a6a8afee4124ef3e602b8c1b83e5e8eafd1d38340ae736f37cf8258f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565797, "uuid": "d004ffab-160f-4812-8de8-a21853c39135", "comment": "Malware payload (Heodo)", "value": "5759c5d177f69ee13828596a3031063afd602d70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565797, "uuid": "ab0c0e07-dde2-4707-b7b4-faaaa1427413", "comment": "Malware payload (Heodo)", "value": "288f510982192a234232e423eda08ac35c80391bd01874df69a79fb95aa89cc98e9cb5833d2cede7fe978c300b7093a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565797, "uuid": "6d3bdd92-e7f9-4e27-a779-d67b9176715f", "value": "T161B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565797, "uuid": "78f293e9-cd7e-4507-8aca-ae6c4341be36", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565797, "uuid": "64ea57b5-c8ef-4120-adb9-4a273bc2c65f", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wjIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzW0zo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565797, "uuid": "21b8b771-f22a-4817-97bf-36ab6ffb332c", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565797, "uuid": "70fe3ef0-197f-4b1c-8012-19cdca14a869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565797, "uuid": "bc7ffa7c-d5e4-490c-acfd-fcf7e3a33ea9", "value": "a4306ae5e75e4d0a8599ae04e8d5c4ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ecdb09-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564917, "uuid": "72742931-0aa9-4276-b5cb-0b59fa455bd7", "comment": "Malware payload (Heodo)", "value": "5222aec2784ca5200e7c694de327d6ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564917, "uuid": "29cbc94c-c550-492f-a492-6e94350e529d", "comment": "Malware payload (Heodo)", "value": "5676d260afcb024454b45b68a0c5a135b5b43126558c1d4f01794e04997d51f1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564917, "uuid": "87511da7-861c-4dd8-af80-7977903a0804", "comment": "Malware payload (Heodo)", "value": "a811c8ac75ec0f1e1388bacccb3abad12dceefbb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564917, "uuid": "8e299720-994c-46da-9260-67cc0fbf9037", "comment": "Malware payload (Heodo)", "value": "5af559c3e73f8a9a119adbc0e35f52b9716ac9aef33568fd3f9b5baa7ba764b4c411ffaa66d15a63a18e56627c8da7f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564917, "uuid": "fb700629-d645-4d87-aa44-b6299530d89f", "value": "T174A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564917, "uuid": "224b56df-5e05-4936-a464-b0b52a982f85", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564917, "uuid": "bbe92756-6d11-4592-b36e-e1f1e6c55bc9", "value": "12288:vicw4w2Vb0zq6k5Z2mTljqkGXNrGHORQuBT:viSwub0W6LmTzwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564917, "uuid": "b09c8be6-eaf1-4d15-bf2f-747884a730e7", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564917, "uuid": "fd9b8bc4-e91c-490d-802c-6ad36c9ee933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564917, "uuid": "a1968493-f263-4c10-8aab-0f23aa310829", "value": "zU2e08r8vOZX7wrpAzvcpzHWuW9kf4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bb1487-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1645515932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515932, "uuid": "d7323ea9-5a6b-4a19-9268-ed950f4f477c", "comment": "Malware payload (Vjw0rm)", "value": "8d2786e0a6c850c170c679a54e0d5f20", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515932, "uuid": "c2b4ca34-45d0-44ec-860d-ca43d518a04e", "comment": "Malware payload (Vjw0rm)", "value": "56996c6145346114bcefd9028fa95a8232d1ce0e380e216a06975d7cad14c649", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515932, "uuid": "c935078f-53fb-492c-b687-9c943372e7c3", "comment": "Malware payload (Vjw0rm)", "value": "0fd46e20522fd76ea36953c971fe93c8b03f7a23", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515932, "uuid": "7e64b5ee-2130-4c96-9e5d-d0428b5b4f8b", "comment": "Malware payload (Vjw0rm)", "value": "91023fbc393bf853268d551ed4f3c2ca1d5a392c076770e9c64573bace239cb87e17227a7937e2de9cfd245708913498", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515932, "uuid": "dc16e739-3985-4384-8939-5b4e74529454", "value": "T18FA27CA80D21EA95DB1049897ABEBCC51FF8C30B5144B20F3B7D77805B72908E95E7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515932, "uuid": "ef023280-f8d8-4b55-bb43-96290955dd21", "value": "384:3fGHqqJpOHJlhBHY9im6C7gpNlUett4tOt+7nVsklRAa9X8fBeI:W/LuDTHxXnpXUettsn0/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645515932, "uuid": "55ace9df-38c4-4151-9891-cc7bef115c76", "value": 21345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645515932, "uuid": "7f5f9b1d-cc53-4fb3-8586-335548dfbbe7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515932, "uuid": "204c8d12-d46b-44e1-952d-03c188564ef7", "value": "Order Receipt UPS1605-192-DD-22.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b91d5fb-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549946, "uuid": "e61b6eed-e3d6-4151-93ea-485df5dcd63b", "comment": "Malware payload (Heodo)", "value": "62528f4eed0fb8cdb3d190451e2fde6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549946, "uuid": "ed82c7f2-da47-4930-adee-497b6d884c49", "comment": "Malware payload (Heodo)", "value": "56ae59747577d9f4b974334739b0f1e881306e90019f94e4bd62637615bd67df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549946, "uuid": "e9ac6e5f-1935-44ad-853c-c859fc632b59", "comment": "Malware payload (Heodo)", "value": "8d97f8c3063b80120644c96d24b59f80ce93ab21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549946, "uuid": "eca3a3c2-36a2-4eaf-a7b1-8e0bd077dcda", "comment": "Malware payload (Heodo)", "value": "56733bbf6b1a058abbd63483d9e8090a37ebe7a49843c0daf68133154b67c9a118b2b7eaf95c6d9f757cac6dc5bf3a3d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549946, "uuid": "596f678f-95ce-4a6e-9817-4ebed6366f43", "value": "T12BA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549946, "uuid": "88dff424-fed6-436d-943f-1bb4b0ce2e08", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549946, "uuid": "02148120-768b-43bd-83cf-fe3532188c5e", "value": "12288:vicw4w2Vb0zq6k5Z2mTqjqkGXNrGHORQuBT:viSwub0W6LmT+wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549946, "uuid": "a876c8df-f1af-4c97-b0df-2cc01fe03e64", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549946, "uuid": "93522b72-540a-4d8d-88d1-a67802214dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549946, "uuid": "1cea0d41-36de-410b-8e3b-162525790936", "value": "emotet_exe_e4_56ae59747577d9f4b974334739b0f1e881306e90019f94e4bd62637615bd67df_2022-02-22__171220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843091f9-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "debf56f3-a59e-4cc9-a282-03fdcbb39365", "comment": "Malware payload (Heodo)", "value": "764f07acfa73491fabc55f392e5275ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "a1419fca-7b73-4e23-b0ce-4ae6596d9c35", "comment": "Malware payload (Heodo)", "value": "5751daf1dedbcdf68318f965cf89d154e75025756544cdb072e77509e3179e89", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "321c0bc3-9fc5-4405-81bf-b026202e633f", "comment": "Malware payload (Heodo)", "value": "596360739a4955d4a3855f80222a35c709ac016d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "34edbf01-74b5-4b1a-b87d-c55076db4d5a", "comment": "Malware payload (Heodo)", "value": "e5323cb13358abfc12ba3344a259cfc27c935b1f309faa975d8fce47ff445ecb888456b26fc7d6d43170347dfaef14cf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "10491c3e-19c6-4052-815d-d23f20138e87", "value": "T12DB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "e8152380-c52f-4602-815e-3e8a19f1ed41", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "2ad6fd51-03ec-40c7-9284-6c851200e786", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wiIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWdzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564939, "uuid": "5ff96ceb-fcab-4125-b087-99d390847259", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564939, "uuid": "ed851338-1abc-44b4-9b7b-0ec0a0c801d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "c3d6e8dd-4a4d-4f96-83a7-248d727dfb7b", "value": "emotet_exe_e5_5751daf1dedbcdf68318f965cf89d154e75025756544cdb072e77509e3179e89_2022-02-22__212214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2a980f-9414-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645557812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557812, "uuid": "cb01270a-9cb3-4a5f-8db2-31477a6f470e", "comment": "Malware payload (Formbook)", "value": "f6057b86cd46c6711176fe8666aae991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557812, "uuid": "6dd283da-cc1f-45fb-ba5e-eb0d14e623be", "comment": "Malware payload (Formbook)", "value": "57b25ebb8680e615019f3c5a9c25853cf6af5c634c729f183016d2c06a78171a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557812, "uuid": "906db20d-41df-4935-8d70-556acbb86b4a", "comment": "Malware payload (Formbook)", "value": "377e9781d20bf043ca11e174335b7b873e2cf14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557812, "uuid": "17e59d19-101c-416c-8ce1-38f3e92effc1", "comment": "Malware payload (Formbook)", "value": "99c7e4f4c8f5f4dd5f751adb197c6f3fa3ee262d56faba0964bea2a782973c4eee471e16feab87b8c343d8fe5f0d2329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557812, "uuid": "d449619e-12de-42f7-b3ff-cc275031173b", "value": "T1C53633C6FAF14826CB034DB474A551AEED792B509A33807365EB409E9CC57FC931E22E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557812, "uuid": "26011688-90c0-4b96-a801-5da7f58e4178", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557812, "uuid": "bf383c14-7080-4f07-8ce5-652ac1cc5199", "value": "98304:J0deaIj6VibW3TxhLZXmWO9/idyp3+++XN8paVT5aPwcTn2cpiXCKs:J0dHIj6Qb6hLFOgGpvT2+iXCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645557812, "uuid": "e16ec562-181f-4b4d-ae3a-553bee30b141", "value": 4908640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645557812, "uuid": "f27a6aaa-0623-46f8-b576-09d3ae8f7529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557812, "uuid": "f47a958a-eb2b-460c-9d0a-3f164b45b98c", "value": "SecuriteInfo.com.Trojan.GenericKD.48411842.4388.4332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bdc78e-939e-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645506777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506777, "uuid": "df2ef219-e678-40a2-a83f-4f8703ad12a1", "comment": "Malware payload (njrat)", "value": "dfcdb78709e1884503ba640faf068535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506777, "uuid": "e42ca095-a478-4994-bbf5-8f074d47feb8", "comment": "Malware payload (njrat)", "value": "57c1d0d2e384502edddde012d5e8e75abbcaf3e3069578d47c32e75624e78962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506777, "uuid": "ec444c29-6a50-4ebe-925c-3cf2eeee417c", "comment": "Malware payload (njrat)", "value": "97df1fa374f20efcd7f64ee2a24c0ad06f8be502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506777, "uuid": "d110a2eb-2150-4ca1-a6da-c609581f3ecd", "comment": "Malware payload (njrat)", "value": "7891045122f257a3be1f48e1ec8c237e0f114cd33f6091dd36ec14fcfeef8329e6cf2c7955d4252d4b47c467ed0b8536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506777, "uuid": "cd41a18b-18ad-436b-a68f-8fed2ac39d54", "value": "T193E217467BA54219C2BC6AFC8DF313210672E2478572EB6F4CDC88CB5B676D44241FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506777, "uuid": "673f31d9-9039-4ce7-aaf2-df9e0901a700", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506777, "uuid": "77aafad5-0e50-405a-98c7-c7e5b23f28a3", "value": "384:s0bUe5XB4e0XXOhhFLH2WTZtTUFQqz9WwObbd:5T9BuerFLF93bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645506777, "uuid": "39397a30-8aa5-4190-83e9-43e6f6554e8c", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645506777, "uuid": "ec93efe2-0940-4256-aaec-469eba971405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506777, "uuid": "7ce28ff8-2abc-41d8-a4a8-c3bb635b0eef", "value": "reald27.duckdns.org.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8705c82c-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503955, "uuid": "77091c3f-f0a8-4218-a2e6-035e9713838f", "comment": "Malware payload (Mirai)", "value": "f401357e0e9757bdaa2b33969d897152", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503955, "uuid": "053c61fb-be3c-4a0d-92dc-6b30a6a4b82d", "comment": "Malware payload (Mirai)", "value": "57c71aee92303498151c092bf0d5ff3ea2a11e18af86fd9afb94f47e68526ac9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503955, "uuid": "8dd6dae4-c78d-464b-8b37-4a422a1a9d9f", "comment": "Malware payload (Mirai)", "value": "f12de94f348204ef912a8dc5597903b0d0f43b43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503955, "uuid": "34adb5b8-9083-4a19-be4a-5c29d781d0a1", "comment": "Malware payload (Mirai)", "value": "1e18b4cefdae0b5e33ea13b7e9959c6b7e0a58b1f6a409d48926eb03928e34c6f6213d0ffb35e2b24f4af9273ebc456e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503955, "uuid": "ac05701c-3f80-470f-b346-656f94f7c6a1", "value": "T1BEB34B22BE56082BD4E4763E62F78331F1F3634A60788B1E3DA30E89AB357503567765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503955, "uuid": "1d55f7d6-6406-47e5-a119-4e6d81802610", "value": "1536:dN1tRgPmwHzHSJ1g2vq6VzwuDNNCF0hZjRstlas5RtthLgw:P1tUmiwK2y6twuRNI0ZWracbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503955, "uuid": "fb1f2a48-8dfc-4358-8159-ebb1c9fbb777", "value": 107904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503955, "uuid": "702510d7-d221-4d63-8982-c641ea164f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503955, "uuid": "e454e1cf-dd9b-4e00-b46b-d30f9205820f", "value": "f401357e0e9757bdaa2b33969d897152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf980414-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1645518223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518223, "uuid": "24ea1bb0-25e7-4320-82ca-15e388e8fc2f", "comment": "Malware payload (QuasarRAT)", "value": "ef0bf5f12cd6fd6a727cc2cbc9286f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518223, "uuid": "915b5597-8e92-4c66-9711-52cf8760d9ea", "comment": "Malware payload (QuasarRAT)", "value": "58050bfa2adf1ed440c74ab9dd144e81cfc56431ba4ec58370d1a04eddab40de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518223, "uuid": "70c14293-7628-4d9a-b95f-ce31cce75bb2", "comment": "Malware payload (QuasarRAT)", "value": "10ec5eee1c55b0600bc992b7ff821ca891642695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518223, "uuid": "4b084d5e-ae24-4071-8a3c-8b0de339218f", "comment": "Malware payload (QuasarRAT)", "value": "e570987552e86d4633cc0cd900def608171de304ef4dbe312826f2f611771c6d04031977520954a885f41fc4d9b0c4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518223, "uuid": "c833271d-60cc-40d7-8a52-e0bf27ebc88e", "value": "T16E748C2377A8E93BD2BE173EF03206154BB4D647B616E38B5A5C55B82C133868D903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518223, "uuid": "af4eda32-2c32-446c-a476-56a8ee37d0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518223, "uuid": "e7262022-cb9d-4f23-8057-2ad33d82c951", "value": "6144:J2NHXf500MvduUwwVhbQvblZlfqavjkHTAJHRdJS:Id50yUwwV2JXfhwTiHxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518223, "uuid": "8eb82ea4-ae3f-4c8d-92b1-886d9ebf9e58", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518223, "uuid": "9307e56e-aa90-473b-bbf7-72a4da4139eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518223, "uuid": "f3897008-2a3a-4181-9bfe-2ff3b7311ac3", "value": "ef0bf5f12cd6fd6a727cc2cbc9286f92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044c1a3d-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645518339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518339, "uuid": "16a938c8-f646-4fee-8a1f-7e8d2da03a49", "comment": "Malware payload (Loki)", "value": "ea21dd9abf6ac983766eb7dd27448757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518339, "uuid": "9a3d79a2-fbe8-40fc-8bbe-3791adf41d86", "comment": "Malware payload (Loki)", "value": "581b717e94c073b4f2ad745e95ef079bb62b78254f41e8842a78c882539e8cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518339, "uuid": "0f2b0b92-0920-411e-a291-94e7214367e7", "comment": "Malware payload (Loki)", "value": "3ffa98f41e63aa128bb01fa4f34bae4f3f438c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518339, "uuid": "6215621b-dcf4-40f5-94a9-07b837585533", "comment": "Malware payload (Loki)", "value": "3da0993536e0a7a319ab28b9e37132ebf45fc4388fb1fd3214ea53b4ece29c37ab9a8cfb6f74d4f40801f960b99a0966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518339, "uuid": "305e5a4a-5701-4be7-a456-2de882948065", "value": "T182E4DFEC387B40F9F3268EBE5DDCE570CF79A6262505E4B978C92F164701B8488D2279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518339, "uuid": "b9e05786-ccf6-4b48-99b2-dd965af37fcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518339, "uuid": "f0742626-dd0a-490d-8574-66fdf8b5e243", "value": "12288:fncBby0chFFQWNiJwjhNTpwjJhmsMIhnJI8a4g7jnc8ZMNV3/lNDWE:fncBbHchFQijD+G8JAeNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518339, "uuid": "aac2c350-c403-4dbc-9445-f750e1507e8f", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518339, "uuid": "48792acb-c615-46e6-9868-b21288c190d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518339, "uuid": "620965ca-42e5-46bb-9e31-a2e5aac6a2d1", "value": "ea21dd9abf6ac983766eb7dd27448757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa719582-941b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645560708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645560708, "uuid": "c3c6c7f5-6557-46d1-8e6c-7f10ed554671", "comment": "Malware payload (Heodo)", "value": "8ba05c5653ab14ae48058c70e401fbd3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645560708, "uuid": "a547918b-2ef2-4126-822c-71ae0c566203", "comment": "Malware payload (Heodo)", "value": "5831910f2f74786d8f73c6f186d75509d5feaedc16f82a2900093c17f5535887", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645560708, "uuid": "23061b95-ac08-4868-94bf-48dab78a4bd3", "comment": "Malware payload (Heodo)", "value": "93380e7a013a08670704593b3317afa9ff165738", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645560708, "uuid": "93f5af22-4385-49ed-8f2a-2a9176dc6bb3", "comment": "Malware payload (Heodo)", "value": "9a066264f02cc3cf5f470b5c3ac576f5ba594502f6aed6d52d6c6dde9598e0f39ef5c861181a2209276713b7a05ed653", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645560708, "uuid": "8861b9b8-5a4d-47e2-b89e-8c5a9306773d", "value": "T149930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645560708, "uuid": "5566dd35-0baa-4448-b4a3-08225d1a2eeb", "value": "1536:3yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQqjkWvgrPE4nWHPNc2Ah:3yehv7q2Pjx45uoDGTj+5xtekEvi8/dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645560708, "uuid": "b6a68554-2e90-4a47-862a-1c15c7a05902", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645560708, "uuid": "3bd133a2-ca50-4d68-81f6-93bf487a09b0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645560708, "uuid": "b768a985-f2a6-4949-b850-869ab6795b37", "value": "100529838752626984388.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18db1ea-9419-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1645559861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559861, "uuid": "eb37e648-928d-43f6-96c0-683d11263c2a", "comment": "Malware payload (QuasarRAT)", "value": "b77d317a8523525624976fd4a92960ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559861, "uuid": "f4f4f157-c229-4e80-977c-0fbe17a9907d", "comment": "Malware payload (QuasarRAT)", "value": "58ed54c59f857cd80bcf4e49b164b812663ae6dce30c39dfde96e5fb69bd7e39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559861, "uuid": "8621fa98-0ab4-49a7-a73e-f344190973ae", "comment": "Malware payload (QuasarRAT)", "value": "af4a1c2ed4360c4f645923c4099fd81e017e337a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559861, "uuid": "3fc02a80-e579-44a9-8728-ac5d44b86c1b", "comment": "Malware payload (QuasarRAT)", "value": "91be8f63f941c44d42407ddeabcced55e617f660caac11ee9e25a0a2fc5056f488cfa5f6cc91c9a32c61cd818b151cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559861, "uuid": "f0e0ca22-a0ba-4e99-8ebc-07dc39d17089", "value": "T1D9D55B1477F84E27D06FC6B2E9B0401667F1F82BF3A3AB8B9186A6791C53B104D417A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559861, "uuid": "711852f2-9024-48e7-aa71-c032f9a4d9a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559861, "uuid": "d03af1e5-8c2c-4677-8363-ed3552d693c2", "value": "49152:V+hf7QQGj33SmdY5sWfLeG2QRaRaO7x/OtOFXCOza32ehyfTnm:V+hQQGj33SGmsWfLeG2QRaAO75Oth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559861, "uuid": "d5161806-e3f6-45b2-baaf-98aedd25d28c", "value": 2861056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559861, "uuid": "734ad03c-b5f5-4440-9824-f18340d8a304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559861, "uuid": "9289fbec-0652-4421-97e4-bd56945548a2", "value": "System32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6417a9-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554942, "uuid": "c685d370-bd28-489b-a5c7-bdfa6573f967", "comment": "Malware payload", "value": "59cedcec1c3ac157e059f8b444ead008", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554942, "uuid": "49115700-3605-413b-91f0-20861c265220", "comment": "Malware payload", "value": "58fda36e241d45156b32e7d3c16ba7fc408dc8baa424dc45cabeab546d35fa39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554942, "uuid": "aa453961-ac70-442f-a6b0-7508a9f555c5", "comment": "Malware payload", "value": "23c39e0687e9de028ebc06c3fa32307c580a7053", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554942, "uuid": "af36a601-5410-419b-a659-ab1cd68c9879", "comment": "Malware payload", "value": "4fff3f5ae85f50fdf09fe8d2ced8028f70ae193d0dbe333daa8ac6933cc51068a1303c7607b73b74e838d5bad91c5811", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554942, "uuid": "1e74548e-d412-449d-bdc0-fd7ae61c5387", "value": "T149F21ADDB801AE7CF42FFB7E8412090AF161B74541925B37637BFD53AC321A49926D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554942, "uuid": "30d30cb3-5deb-44a7-b33f-bf34518b85fa", "value": "384:440eg0fiTgymFJGn7vbr/RwXeuNCNzcm/sD8WAzADt3qHQpj/R2w74W3CYG8X/3P:41eRS7vbqX0X5pmhqHY/RfkWI8XpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554942, "uuid": "c4fb38d8-164b-40b2-b906-365bf37994de", "value": 36960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554942, "uuid": "68a60c9c-99a6-45d1-8c81-87acbb84a45f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554942, "uuid": "376ea2b4-5bc4-4744-9191-0fd26ccb741b", "value": "59cedcec1c3ac157e059f8b444ead008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d517e8-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555714, "uuid": "735c675c-854a-42f4-a2a3-447d046b5323", "comment": "Malware payload", "value": "ec6af91f691892085d534ea8721c69ef", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555714, "uuid": "edcb472a-fa0e-4c3d-9b4b-c778ffd41d7b", "comment": "Malware payload", "value": "5905d5e65e582a674fa51e0c96427a3137ad82b2cf06332c7b08d1e498edfc1d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555714, "uuid": "3608350a-8fba-46cd-aa81-25c41e3eaa47", "comment": "Malware payload", "value": "06891a461552a7c4b88aaef041b77bef945becfc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555714, "uuid": "5be5a6bc-1d2b-4548-9f7a-69ae3691e4f8", "comment": "Malware payload", "value": "72ee9ef703d3d2e785b04c6c510e6f2ff3c5f7ceb586e2501707e653acc54616ee4c089f239f37770009d4bdd6cbdb22", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555714, "uuid": "58486213-5b3e-48da-b9e4-4abd704611e0", "value": "T13D93F769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555714, "uuid": "9318af02-943f-4a1d-880e-6f0762d619c4", "value": "1536:Hyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQxukWvgrPE4nWHPNc2A+:Hyehv7q2Pjx45uoDGTj+5xtekEvi8/dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555714, "uuid": "dbd14314-ce7c-465b-8045-fc854978d1aa", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555714, "uuid": "2e499a91-7b63-40f2-823d-642ac3d63390", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555714, "uuid": "3cee0f15-a897-455a-9c3f-3d8020557eb2", "value": "tmpzc0fn3b_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7f32a4-93cb-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1645526169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526169, "uuid": "f382efe4-43ca-4b2b-af2f-e9e02d57f9bf", "comment": "Malware payload (STRRAT)", "value": "083fd388943aa92533d7b63d7d0bda89", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526169, "uuid": "bd9e5af4-bea3-4d5a-a73a-004f8bc02899", "comment": "Malware payload (STRRAT)", "value": "595ab2d1b7478b6c6a18fec3698cb131d8115c346b0408c6667aa6561a443c2b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526169, "uuid": "8d1c3eb0-07b7-4a2e-a780-de2b76bed526", "comment": "Malware payload (STRRAT)", "value": "48beba363d91e88766c1466036aaffd0d4b7f931", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526169, "uuid": "26d6a46f-54ab-41ad-a1df-dc014afd2461", "comment": "Malware payload (STRRAT)", "value": "43e5e72eac92aae4e223162749ede1458c0f057ed775609ec1ac23a9ae5d3fd21d0589d563b103f3197cfd69b239e856", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526169, "uuid": "5011829a-e932-4175-ae9c-b5a1cce0a79a", "value": "T105C312260D388ACAC5F393D10B1ACC2E6CD8891515FBD4F59F0A25D5E3F0F8A12DA75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526169, "uuid": "3ebc6a0c-fa6e-4cb4-9221-cfeb8f849223", "value": "3072:D3d4clmJsvUeNQFuWLRqwecmtmOBFWuV86kl+Lcej:G/JsMQyMbcq9FH86klJej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645526169, "uuid": "6d7a5615-4fc5-40e4-b329-f256d95128ec", "value": 126854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645526169, "uuid": "0f450686-9a05-4dcc-ab30-8b65710a167f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526169, "uuid": "e2be4b93-f615-4ded-8a34-a29d4d140d2b", "value": "34565434567654577654.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d72272-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645518395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518395, "uuid": "f8fa78f5-72e9-4d0f-aec1-f39415c7beb0", "comment": "Malware payload (AgentTesla)", "value": "39ba72e785d4771653efc67527110805", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518395, "uuid": "0b12d63c-3a47-420e-a933-d228d7592460", "comment": "Malware payload (AgentTesla)", "value": "59798244db2c64ef5c6202f2971657367795489627eb80c68059d59a026a432d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518395, "uuid": "5fae1684-41f2-4f1f-92d1-8741826c01ba", "comment": "Malware payload (AgentTesla)", "value": "d7725b5975acd0d842ac12676d2f7bc731227a8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518395, "uuid": "e707c908-f54b-4e54-a453-52ad1641ceb6", "comment": "Malware payload (AgentTesla)", "value": "af2616a2d5b51559536fdb7de39fbcf3ba6d009452c67fee62f6340cfb743cc96949634751b13c00c6b4214f6195567e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518395, "uuid": "0d8ae1a0-f9b6-4784-839f-7dbfe3b0d083", "value": "T1C715CF042AA71F3DF0B94BB648D4EC64F7A9F7231C15F37E7D502596CA52B408D822BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518395, "uuid": "969116cb-69c9-4f11-a580-3db1e7df62ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518395, "uuid": "557e78c2-2693-41e9-a333-012d103011bc", "value": "12288:sgB6AYlNEh7jbVn9rwcKP8hxQDV3ErG4Se/v6LMs1UfcN4LVUytPllesV4Xp7tk:XYlNCVn9rLTQf4DX6T6fXvlhVea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518395, "uuid": "0519dd98-5095-43f6-a82e-ada46180b319", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518395, "uuid": "e6e255ac-6974-40bb-a40b-9b2ed635ed6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518395, "uuid": "492ebc54-0fe4-441f-8f1f-c01077cbdc62", "value": "39ba72e785d4771653efc67527110805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cdcf3e-93d0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645528592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528592, "uuid": "0e6a82e1-5d3c-4f32-a02e-b82c0ec3a948", "comment": "Malware payload", "value": "e6944f7b9f97ff93f219a224ccab9b74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528592, "uuid": "53c5c675-1cc6-4b1c-a938-0dbf6bb5ce78", "comment": "Malware payload", "value": "59c42b7a8c88c10e69dd975cad42a8b27828ab3b4961c64b8568390194873225", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528592, "uuid": "775c63cd-6082-4078-94c4-987074312d25", "comment": "Malware payload", "value": "ebddc5617048e02c5dbc9067a2c38491b1c23d33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528592, "uuid": "9530aa80-e74b-4a6a-a75a-65147a5978ea", "comment": "Malware payload", "value": "b34aea78f1633e227fa5d669b96ea899d27319cb7ef1939981ac3e9dbe7cc2ab8240c7a333cded12de95f5b696f03da4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528592, "uuid": "d9934b47-8db8-4974-ac04-c8c773e70a2e", "value": "T10841111DCC5B427FBFA15F4142819C10CF49908EA385662476DD9B1CCA93F50A33D2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528592, "uuid": "c8b476e9-37d5-4a56-9677-75b809b9d9c7", "value": "48:aYRzjYx1/I0BgGGseC4yprW52zydVJU36bQ2zydVG2SJFxstA1:aOXsa9ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528592, "uuid": "de4ae84a-c1f2-460e-90e2-494cce87a4cc", "value": 2394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528592, "uuid": "68956880-e4c6-4238-816f-c1fe13580b00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528592, "uuid": "93b097d3-65fa-4a96-9c87-6c4819da6bb5", "value": "LMSPass.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f364631-93fa-11ec-9275-42010a9c0029", "comment": "Malware payload (DarkComet)", "timestamp": 1645546274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546274, "uuid": "ab5706f2-7c8f-444f-9a53-c3f1021f2086", "comment": "Malware payload (DarkComet)", "value": "ac5d11be5c53c47bd3a3b8dbf2d1bdac", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546274, "uuid": "2c5872de-8b8e-4748-a8dc-1c50ff882961", "comment": "Malware payload (DarkComet)", "value": "5a3b153c29757aa2a325cea2dcc162cbcb760f63200db318bf46ddd32ee428c2", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546274, "uuid": "773abc0e-cfc2-4da7-b393-345389b723ef", "comment": "Malware payload (DarkComet)", "value": "4bd53a5b55d3761c889c708f899ed4cbac1b8337", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546274, "uuid": "1df21d7b-4b26-4c53-a712-dc55ae485db9", "comment": "Malware payload (DarkComet)", "value": "04f0f40c8ce04c5d925e8b2e6c5e900a3f642d079af98d6458ad8fcc50b4fbf14d40cbc4113e40575f5c887d9c428479", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546274, "uuid": "dfb77961-4422-4fce-8c90-b89ee00bd2dc", "value": "T14675DF00266BDF39E1750FB158C4DC60BA74A6E32C38AF2D3D70258ACA11BD199CE776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546274, "uuid": "548ac7c5-ea83-4175-a770-74b4163472a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546274, "uuid": "2696049e-c129-4a8d-8036-a17b0501c1ff", "value": "49152:/f8qhGex5wLAFJW0CsrCN29ndjPbYXcZm08:/k/UwLAFJW0fa2tdjPbwcw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546274, "uuid": "3d470387-4164-46e3-b0c2-90a7c1aecd6b", "value": 1702400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546274, "uuid": "1fd2515a-4a4e-4156-9719-61f6ecb6a6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546274, "uuid": "28f5c78f-790d-45d5-857d-6546173b6acd", "value": "PURCHASE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a1e76a-9385-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackCat)", "timestamp": 1645496224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496224, "uuid": "096700e0-aa6a-44ca-8a58-840c9c9a4aeb", "comment": "Malware payload (BlackCat)", "value": "9502d64e8f8c0f50127e2a7263596891", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496224, "uuid": "9e3a592b-1af8-4610-9e9b-b9234c6ef150", "comment": "Malware payload (BlackCat)", "value": "5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496224, "uuid": "b69b0dbc-6150-408d-bfec-19cc7c679e07", "comment": "Malware payload (BlackCat)", "value": "23006c877ccc883460497ad35df82e64f338cfc9", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496224, "uuid": "1b32ab21-8f62-4041-a3ec-fa039305f997", "comment": "Malware payload (BlackCat)", "value": "63142c9b22a81053f262427b2f4b4e9881bc856e0a55a52ec6ce4f3513a86630ce9106bae370e8b4811be07124452d25", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496224, "uuid": "f21886a5-2f80-4b66-9d9c-e30058e6b84a", "value": "T14AE59E47F98356A9CDA71A70305EF33AE6314818452D8EA3E7F8DD207A2E7105EC9E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496224, "uuid": "8ef9fbba-f408-433d-9595-c6f5acae85f3", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496224, "uuid": "14290e7f-7f06-406b-a995-8699429f53d1", "value": "49152:xFyDutqk4eYTFUoXhjEjHjTu5tCeOZobIMfutoqKNx/RgaJ2weF:xFyDNFLXVEbjTuieOaR2+FvwweF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645496224, "uuid": "db4c5afb-7cbc-4652-ae1b-1cf16b9183bf", "value": 3081216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645496224, "uuid": "66348f7e-32b5-4860-ab69-e58d56ecb8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496224, "uuid": "f172fdab-7b67-447e-a630-79ed8aed2c27", "value": "5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa317b1-939b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645505795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505795, "uuid": "2f1385e3-8130-4a3d-96ce-9dbcd2240d1e", "comment": "Malware payload (Mirai)", "value": "07fac6734cdf60aa3e20fb7aec09498e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505795, "uuid": "8e79a905-eb53-4afc-9d78-02d0e3de829f", "comment": "Malware payload (Mirai)", "value": "5adf9ea96d98274173985e86307a3ca77e0fd3b2f6e9ca77f5de4403a0b17da7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505795, "uuid": "53700716-d1d3-4074-b03e-0422f8fdd1ae", "comment": "Malware payload (Mirai)", "value": "90ebf5bb8accbcd1dd770556af48716a871089db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505795, "uuid": "bfb33535-df8d-493e-83e1-c3a6d5326b70", "comment": "Malware payload (Mirai)", "value": "4da53d1d801f3172248e673f6eb1d01f3ac8b96a7966dcb7e5452be997ff61d9aa6b9303546bcdeb569f01e8429cd7c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505795, "uuid": "f3702a1d-32c5-4efd-afcb-6c6cf8c6f214", "value": "T178C2E1EDE08859CEDADD7CBE506C17A607A9B1A4E35ED6C58308EC10CB54F06776E078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505795, "uuid": "3123f089-d097-41c9-91f7-982beef6a917", "value": "768:X7HZK4GKG1HGb1vCcKM8DCRgSCP3K9WMW:XjZFtxvCcKM8DCmSC/Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505795, "uuid": "55016680-3c45-4b7a-9577-4ded7b0374be", "value": 28284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505795, "uuid": "498a15b0-93ec-4332-8f0e-81b19789fd22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505795, "uuid": "c91058db-6a47-4ddb-9895-1191b3a597f0", "value": "SecuriteInfo.com.Linux.Mirai.198.6788.26881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e67643-9406-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645551445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551445, "uuid": "fe1de37d-80ea-4e9c-afed-de16864ab6d9", "comment": "Malware payload (Heodo)", "value": "b664bceec240e8569cbecdb573d274c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551445, "uuid": "fff77821-dd2b-4a6e-aba8-1df324aa7cf5", "comment": "Malware payload (Heodo)", "value": "5b95915a6d63e892f129e4a0119facf230ccff0b264c6b710fcb17cf2e14f967", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551445, "uuid": "07877181-db7a-438c-aa9e-f8fc1deb1792", "comment": "Malware payload (Heodo)", "value": "fa28bf3e572d12f621c54b44ee6671536d68f17d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551445, "uuid": "3de7ceb8-1790-4bbc-90c7-373ac9fad143", "comment": "Malware payload (Heodo)", "value": "469b355af305ad2e26ded8d8ac62309b4ece51d9d05799da07932c1b9904b1168e5da6d9f3ce3557dca76d9eb3a30979", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551445, "uuid": "6f543a5b-13d7-4090-82b2-e9e38d529747", "value": "T152A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551445, "uuid": "1ea9132a-662e-4e3b-b507-4a7e08e2f66f", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551445, "uuid": "37cfdaef-2f53-40cf-8543-f4ad7d33f865", "value": "12288:vicw4w2Vb0zq6k5Z2mTxjqkGXNrGHORQuBT:viSwub0W6LmT3wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551445, "uuid": "2e747977-f820-4c32-bd8b-5f8ca3b54cff", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551445, "uuid": "84a789b1-ecf6-4c15-8895-807d3078885a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551445, "uuid": "1bd1cc4b-65ff-4aa8-9c77-8f876151f6ee", "value": "b664bceec240e8569cbecdb573d274c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d53c03-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645517918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517918, "uuid": "bebad41b-1e1e-496f-97da-66a8d6853960", "comment": "Malware payload (AsyncRAT)", "value": "9cff237608c23075ae466e7c6eb1b35d", "object_relation": "md5", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517918, "uuid": "ba9271ba-3a04-4e7c-a94e-e46bc3d5f36a", "comment": "Malware payload (AsyncRAT)", "value": "5bc250fe115f0af94d9d57840c5aa4ddc91b5c3f4100edba4e154cd438e8d682", "object_relation": "sha256", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517918, "uuid": "4e794b5f-2ee4-48b2-94cb-97ad104a17b3", "comment": "Malware payload (AsyncRAT)", "value": "200fea121d0315ec0533bd483679c7c61ffec090", "object_relation": "sha1", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517918, "uuid": "704c47c3-d300-462e-b3c5-e2f88f98b3eb", "comment": "Malware payload (AsyncRAT)", "value": "b0c3662c7cb762f8af9258d7419f6e3943209e4c161cee13b030cf5abc723e1f2b944b0514513c77fa5a5d251b44fc4c", "object_relation": "sha3-384", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517918, "uuid": "832ca199-6277-4857-b000-6a7e5654f8e6", "value": "T11F231A003BE8812BF2BE4F786DF26145467AF6A33603D64A1CC451DB5A13FC696426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517918, "uuid": "667050d2-7cc7-4b27-97d0-50e6139bec7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517918, "uuid": "3f6833f1-85c6-49f3-8e3b-913cc3ef2a1d", "value": "768:zuQKNTREhzxrWUXWm5mo2q7Lhja7OOPIzzjbGg13iRdDT1NsxE7e9BDZzx:zuQKNTR+J2oSO3z3bZ1SzD5uxE7eTdzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517918, "uuid": "a6705046-1480-48d0-a235-771823428ada", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517918, "uuid": "ccddbac7-d6f5-44d1-9063-825509b70794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517918, "uuid": "47c00fc0-eeec-4b3d-9733-aacc39768bef", "value": "5bc250fe115f0af94d9d57840c5aa4ddc91b5c3f4100edba4e154cd438e8d682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ba32d2-93f3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645543337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645543337, "uuid": "0d58399e-20de-4457-88d3-ba62f7e7f31f", "comment": "Malware payload (AgentTesla)", "value": "d3858848b5586510ef2cd82789ea7332", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645543337, "uuid": "b5cc3a4c-daf3-479d-93a3-93474bffff2b", "comment": "Malware payload (AgentTesla)", "value": "5d7b9653e08da84acbd485fb4a4454f0f805de832b724a42cd921c6af8889367", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645543337, "uuid": "c025a248-2fe1-4526-b490-45ec48d9a4c8", "comment": "Malware payload (AgentTesla)", "value": "590102f92b950559bf6c30f7f15832c72e44f328", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645543337, "uuid": "6ec1ef25-b895-4e33-827e-b95f2d266bac", "comment": "Malware payload (AgentTesla)", "value": "78adfaa6d7db31b7ec540c04ba032cc87a8b1dec1ea9c2fc62011db8112291af3e3bf805f212a09cb225598fc564ec90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645543337, "uuid": "c56b1d82-e9dc-4c00-a793-b6b949f4111b", "value": "T17AD47BA121E6CBB6E5FC93B8F42250F60FF07D59D611E52B3D903EC975B2E402663622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645543337, "uuid": "690a78dd-11bc-4074-9ec3-3ad488147f89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645543337, "uuid": "cf4499c8-ea15-438d-9cee-fd3c9e72d4f0", "value": "12288:y0FJJZO6qH1h+4VHSpxIkf62Yii5KvzpAz5fJu9J5DMOIf04TVoByle0RL0s+uXb:zY84p4yleMLj+uXt6ee9ueVFht2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645543337, "uuid": "5391a9e5-2a5f-4afc-97db-7cc78e678a1c", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645543337, "uuid": "895430bb-c11c-4fba-91a6-ffae1bf178f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645543337, "uuid": "829b2586-481f-4f37-a1bb-a3c7a231e3d0", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e064ff-9381-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1645494612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645494612, "uuid": "4d241414-1b5c-4259-bfdf-7be674f8b627", "comment": "Malware payload (Tofsee)", "value": "efe1272f496eadc7b6b816ff79cebdc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645494612, "uuid": "603d2520-e41b-4ed2-bf64-4533bc781b45", "comment": "Malware payload (Tofsee)", "value": "5d84be18669beb78b0993523cbaf3e66f352ce34888a6f63245290ca02436785", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645494612, "uuid": "2e0a7fc7-218f-4fd6-ac76-ebd2fcd142cc", "comment": "Malware payload (Tofsee)", "value": "f7a52c6b2fd628e2b3fac3169922bbd5e78f9676", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645494612, "uuid": "e367375d-e99c-43b3-b57c-10b0ba929787", "comment": "Malware payload (Tofsee)", "value": "28bb0d865c01784e88690170a053d1d73b4a2c121b1d8e338124809fc30aed106f5df7aac591897d2f5d665cb68fcdd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645494612, "uuid": "0451384d-e3d5-41d6-ae5c-ed83b99b7ac9", "value": "T12134CE117AD0CD32E5D35E300834C2E4917BB8929B60A5CBF6A87F5F6E353A18676363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645494612, "uuid": "475d03e1-2b8a-47c2-8ad6-e8716d128efc", "value": "e77df1061a47040e786b91ac2fd00278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645494612, "uuid": "ace3b01b-6dcb-4265-b430-8d3a99841da7", "value": "3072:p7nUVBPFErnrCE9g/EdNesxkgaBChrVd7XzG:1mE9gmigaCzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645494612, "uuid": "4a59075f-6fd5-4682-837d-c86cae313fc7", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645494612, "uuid": "ec8f4497-71f0-4699-a5c4-d826bdb06703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645494612, "uuid": "3fb4369c-105f-4966-9b67-19c2b30e9225", "value": "efe1272f496eadc7b6b816ff79cebdc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbe6960-9400-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645548899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548899, "uuid": "a011a3cd-ea32-46d1-9327-c0cbb56db023", "comment": "Malware payload (AgentTesla)", "value": "c6d54f0cc08a3a9cc21eda43395387ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548899, "uuid": "99ae0187-5cda-4359-8bca-94aabe7cac79", "comment": "Malware payload (AgentTesla)", "value": "5e02599c1152dee20e87e0306aee95d602a011ca46276498e3fec5754bc0ce99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548899, "uuid": "587bfa32-06c8-43dd-89ba-f183d905f3eb", "comment": "Malware payload (AgentTesla)", "value": "a592079e109a43e49d864ad5a07eaa999a8370d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548899, "uuid": "3e15a8e0-151f-4b41-ba8a-e9371dd41826", "comment": "Malware payload (AgentTesla)", "value": "9295205e0d62628b3739235fbbc2c038a0bf4ddbe75288a56707094fc7a55643f6361366f77e530e11306a503567d0c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548899, "uuid": "6fb480af-c83d-4d43-9384-20b9281021a1", "value": "T142E45A91BD8C84DAE8246577441AF93512D66CEC43F304DBEFAF3666D8363C2117EA0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548899, "uuid": "f345306d-1f0d-4254-841d-98ede00e092e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548899, "uuid": "5d1c4e62-693a-42b2-b072-67f99a7f6ee7", "value": "6144:QxDKI/OG04u1dqO6GWAFYu6cDMOjbqEw3gw8U8d2uhEnR+iX+o0A7tmm4sFIZQuG:3BD7vqd6by8OL85OYb8Nv0m4hKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645548899, "uuid": "e3c720de-aea7-42bc-9b50-4a01151416ec", "value": 700122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645548899, "uuid": "2fc8d570-dcbb-4dd2-9f1d-7a6b4784ef0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548899, "uuid": "279f5b82-152f-4d8b-9af7-855995f4f937", "value": "NEW ORDER Nr 6543981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9519a0df-940b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645553800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553800, "uuid": "7d609062-0a1d-44f7-8afd-4ad9fdeed801", "comment": "Malware payload", "value": "cd86243c24eb6872908f06c22b04d479", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553800, "uuid": "606c1fd9-abd4-4f94-bf5b-9635eb6cce62", "comment": "Malware payload", "value": "5e54492e078036a3990bbdae1f8eca1f860d794fc92895b5aad52d0ea1f51447", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553800, "uuid": "d16a044d-5548-4cd4-89ad-f2cf4882118b", "comment": "Malware payload", "value": "043c40cadef556d13a500c396c6b5c79a196b7b3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553800, "uuid": "c97fd5e0-9680-4711-bdd1-52d197d3265d", "comment": "Malware payload", "value": "d424d3ae3098617af9929e8bf886e22e038bed2b60f2a012aecd6407a2ecf1d5c7fc16cfae7bc78729f8592e2238e68c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553800, "uuid": "3f353738-1a57-4176-851d-c2fe4d110ee0", "value": "T1AB930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553800, "uuid": "e0c7708a-f8f1-420f-9d28-289d7f5a9350", "value": "1536:5soyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQs3kWvgrPE4nWHPNcB:Zyehv7q2Pjx45uoDGTj+5xtekEvi8/dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553800, "uuid": "50192d6d-03e4-4090-bce7-860f30b91d92", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553800, "uuid": "8d06eded-c013-4feb-9e4a-4b4d9f584382", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553800, "uuid": "9db62893-6410-4837-80ba-7ebb321a7c60", "value": "tmp5_g3gqxx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abba50f-9391-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645501277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501277, "uuid": "3daf6c64-a4f6-4c76-9053-35834508afd4", "comment": "Malware payload (AgentTesla)", "value": "786d76f4013c424e41eab851c719bb07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501277, "uuid": "9ebb92df-b24e-4de2-bccd-4e6c7a9c0e1e", "comment": "Malware payload (AgentTesla)", "value": "5eb43c6504e3f7b1531edbdfdfc446f2796c2901a5a85bec8536360b5f144088", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501277, "uuid": "25a308a1-6f0e-4396-b7ab-aeddf7954a5b", "comment": "Malware payload (AgentTesla)", "value": "f03c9e63b08f079a93f38bae479a5bca2dad456c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501277, "uuid": "6c8de3b3-eb93-416a-b0f1-3cd012649644", "comment": "Malware payload (AgentTesla)", "value": "06db622e56df1042260752cda6ff8878edbf2bdbf64e1532a32c25d4a037546be711ffeab9c37d6002182aee8b4a77d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501277, "uuid": "5c3b20e6-09cb-4fb3-9819-049f24c20668", "value": "T16BF46AA0161E3E9BC5FD52B463141D00A2FEEF526212DF8D3DE160E6F6C2A46C727758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501277, "uuid": "6eb3ca26-84d4-4cd7-a175-53e8a6a98955", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501277, "uuid": "30fe2eae-abb8-4295-87c2-5fb2c43114e3", "value": "12288:TFiTaKz485mds9PMG1csdCb9DyEc+Ch7a/4KTMIhpaF9AkkgW+0ydiO:l5UQsGGQbU+wa/hI28FKk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645501277, "uuid": "68266edf-551d-4bbd-bb28-0d6a34f53268", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645501277, "uuid": "87fe5900-04d8-4e99-b1ae-c2331cdb794d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501277, "uuid": "5ee94d0a-779b-450e-9368-106fb3ff05e3", "value": "NEW QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40c8fa5-9401-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645549584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549584, "uuid": "be897a49-572f-4aee-b55c-4522bc8c4efd", "comment": "Malware payload (RedLineStealer)", "value": "bef8e4146c748bf32d9389ca6deb8f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549584, "uuid": "088666bf-694e-4598-824a-b46d5878af07", "comment": "Malware payload (RedLineStealer)", "value": "5ef4fd560a82075638665b526a2b687ebc5c647a0ba0781b8566433f63c71f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549584, "uuid": "6fcd37b0-c4ba-4352-9a0a-5cc0703c3233", "comment": "Malware payload (RedLineStealer)", "value": "e9916291fc9e7c5b51365153486b5efb4cf9478d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549584, "uuid": "68e10f49-6702-4f9f-880b-0d0a42fcd629", "comment": "Malware payload (RedLineStealer)", "value": "aa8fa8e04007719418059923ae3e35b4df161092cc763e0540074acd210738ce7f9fb1d9e21a62dbc964d073532ecb27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549584, "uuid": "7e9d2446-7485-4fe6-9010-ac5d711600db", "value": "T13216331571679B13CEBFBBF4A358F5F6DBAD12F8E842E5C26AAA464F26544C340100F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549584, "uuid": "4d1cb8b7-ebf2-42db-8b2d-1357cce1b809", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549584, "uuid": "cc14ea13-7bc4-40c8-9ca5-741d571d30db", "value": "98304:xz0EPDRq4HYjK2ezbVggV9PXrOeXdCtEvZIUyR:2EPDfPrWgrPrOEdbvZ1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549584, "uuid": "a1f7ed14-2e8b-4cfd-ab0d-dc8d4a0da203", "value": 4146840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549584, "uuid": "04c15683-0171-4637-b130-ade2e7d153c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549584, "uuid": "69bf11b0-95d7-49cd-b799-438c616f24ad", "value": "bef8e4146c748bf32d9389ca6deb8f16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7418d9-93c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645521389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521389, "uuid": "9f079b92-a1ad-4966-8e05-6307b2ecbec8", "comment": "Malware payload (Loki)", "value": "cdbcebf537a93f7e05b5ae4c565cfd9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521389, "uuid": "ecc5c492-40a5-4944-9b4f-3e6a8b55e7f8", "comment": "Malware payload (Loki)", "value": "5ffc56c61220a361b33eae01a1b7859d93d696962d0de536ddb5e979179c2dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521389, "uuid": "0bc23d54-c26f-4d8a-9af4-08a6268db1e9", "comment": "Malware payload (Loki)", "value": "3aadd2be987f476d496c99e32065699e562cf2cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521389, "uuid": "58674486-cec5-4166-beaf-35eb0de7d062", "comment": "Malware payload (Loki)", "value": "fed2c22aa79b0cdd57eb668e11c44087be1cda698bde306946807fd65d7f33ec14a677cd2baaf8fab4ab727c7e042748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521389, "uuid": "4986b727-9a90-4014-9df0-0c118d9699ac", "value": "T13C34121878D288BFF64B07B147B797F1E3FBE2023661114B0B121FDE75522876A29297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521389, "uuid": "61667bf8-0fb6-4f97-a558-ea58215f0837", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521389, "uuid": "5174a78c-9f10-40b8-aaea-d98a43007fc6", "value": "3072:Tx6UW6tpmJcsofzIbBt+oybDUE9ShfyUoyCg+i1Tcpskrauch7QSQOkhikMydKQG:TxDYofzItTybuEiTcW8ahZZQkEPYFMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645521389, "uuid": "c2515260-bdff-42b3-9903-42b1c977eab0", "value": 233587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645521389, "uuid": "09bb7a19-37f6-4ff2-a617-67e8d62d3714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521389, "uuid": "f40dc7fc-2bc2-401f-b6d5-b3ab19e6f2f9", "value": "masta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbbc52f-940d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554590, "uuid": "06f7f468-a022-4483-888c-3e3f8d95ee06", "comment": "Malware payload", "value": "569fd218752c5d8536b6ea0efef94b38", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554590, "uuid": "1d248e09-be8f-4302-952d-6a50f407ef8d", "comment": "Malware payload", "value": "6096bf9598a9061420f38345366eab0a2f958b964a0ebd21b362d9df8f4b0191", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554590, "uuid": "4a033689-37cd-49fd-ae57-6ccf37210181", "comment": "Malware payload", "value": "970dc5c54af629b1dfff28d2f9603547f00ed463", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554590, "uuid": "004a451e-e351-4dc3-b273-bcc93c912803", "comment": "Malware payload", "value": "a278ee7ff8648f7771a41f057d65e5b6e64d40403d497ba7d1712b8e6c9e879d437968b3152b0de9c46268dbbebc9881", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554590, "uuid": "59eb631a-010a-44b6-a47b-2004172bef01", "value": "T179930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554590, "uuid": "098f898a-5e5e-417f-874c-9d057310d890", "value": "1536:Kyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGSkWvgrPE4nWHPNc2AZ:Kyehv7q2Pjx45uoDGTj+5xtekEvi8/dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554590, "uuid": "226e507c-e83b-4513-9527-53defd9c72ee", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554590, "uuid": "118f19e2-9b47-45c4-a0b4-d78c3c87449f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554590, "uuid": "9a2b3b4c-7755-469b-99a0-769ffcfc0d92", "value": "tmp_b533_yw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1f1c7f-9400-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645548979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548979, "uuid": "f9e735c4-a4e8-429e-b73b-c34bc34629fd", "comment": "Malware payload (RedLineStealer)", "value": "18cdc20ebb4497cfd69c1579eee507df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548979, "uuid": "915f8ad7-e1e9-4a17-a920-365c1be03cfa", "comment": "Malware payload (RedLineStealer)", "value": "60b36d37930ac64123d4b74af02c85f5249889a2f3456700efa4a28051602545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548979, "uuid": "dec8c324-38fe-480a-a5f5-b62cf1e92e72", "comment": "Malware payload (RedLineStealer)", "value": "461ede36e3a6b91c0be0c56d140a37feea156beb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548979, "uuid": "2aa16f82-b63a-42e4-8f76-47e6184c525a", "comment": "Malware payload (RedLineStealer)", "value": "931108b972034ddae3e9adaa38b857522cb563dca7c66fa21ac2fd00cdf10aba318df2434ab48c57e7867e503e3d5559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548979, "uuid": "164e0c1c-bac7-46fe-81de-0bdda68dd38c", "value": "T14354E04257E44993F5BA6B74D4F202035B70BCC2ABB466DF2241568ECF237D0A97670B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548979, "uuid": "38d0ac41-f0c9-413a-857b-f6fb0d695303", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548979, "uuid": "97cd08a2-48da-431e-8c85-87fb4abab5d8", "value": "3072:DyqBXv8dNxY5b+BC3K5eq93iy4UO1kKhrI2hN0RIN0UbLGSoKNDLyWwDAyNZh19T:lk2K75iYMfhE2hNYI9bLRDLyWpuva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645548979, "uuid": "e975f4f2-8aa4-4571-ad81-75a288a18312", "value": 285144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645548979, "uuid": "92e36374-fdb4-4056-aff8-351550e25401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548979, "uuid": "f3a750ae-7c87-4926-8de3-2ef8c477545c", "value": "18cdc20ebb4497cfd69c1579eee507df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b689f5-940c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554253, "uuid": "9aaf23b3-bf44-4bcd-8b23-017242bdeab1", "comment": "Malware payload (Heodo)", "value": "967a2d61a6b3676af51dfd3f2bdd379d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554253, "uuid": "05e8f6d3-872f-4ee4-b367-ac93692eed4f", "comment": "Malware payload (Heodo)", "value": "613fec5c36362a82697c6ca8342b4f0badc40aaa0686d9d8748865a289a29d90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554253, "uuid": "2abc4f2c-e52e-42ba-ae28-40ed55945a39", "comment": "Malware payload (Heodo)", "value": "76e5cc52271c77a10261087b0a22e8dfbf71a7ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554253, "uuid": "02a0d73a-ae50-42b7-a7b9-b6675f7cf694", "comment": "Malware payload (Heodo)", "value": "1fe92606679d4b241ad11320286f6e654dbf8f9d83a4b8da67cf8553ec4befb1aa39ea9a398820697720c2f1d6f34487", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554253, "uuid": "cc16835d-e65e-48c8-8ac3-ac18f6f4e23e", "value": "T19EA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554253, "uuid": "b83df02b-d1a0-4185-96a1-aa50f8e47dd3", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554253, "uuid": "dff1d0cd-4a78-42d7-a296-062a668d926a", "value": "12288:vicw4w2Vb0zq6k5Z2mTujqkGXNrGHORQuBT:viSwub0W6LmT6wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554253, "uuid": "b8e3d3c5-cbc4-4add-bbb1-ad1b072e2a88", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554253, "uuid": "d5fd7af7-ee57-48aa-affb-c29ca7502185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554253, "uuid": "232d3916-8c8b-45cb-8c37-6ef759872bea", "value": "967a2d61a6b3676af51dfd3f2bdd379d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1f10da-940c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554272, "uuid": "cc8b0d73-8cb3-49b4-87d2-763f79110723", "comment": "Malware payload (Heodo)", "value": "4a146dc48c5747b8584b0b35964a608f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554272, "uuid": "d30ac28d-d8d6-4462-8ae9-17e7324c8f3e", "comment": "Malware payload (Heodo)", "value": "61c65a2dbf5916c0f2cdacb92932a794f0e9bd98121652112181877c57d1d70e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554272, "uuid": "0387c4c2-3eca-42dc-9f68-55351623a8e9", "comment": "Malware payload (Heodo)", "value": "f51f6e9beda4314ee8250914afa46db391aded85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554272, "uuid": "8d135524-6d5f-4002-ba81-523fa2f83b6d", "comment": "Malware payload (Heodo)", "value": "fdbd7216bfb8717f69367d51a4bce60761dd2e00f6fe27875fb7e54f3e5cf20587ea0c79e2031e0f1e303563787592ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554272, "uuid": "50f23c43-b6d0-4ca4-9712-07a59a367425", "value": "T14DA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554272, "uuid": "49aac0c9-8a7c-4095-93e5-247fda410cae", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554272, "uuid": "3fa8cc89-903c-4234-8a09-d5e457f17822", "value": "12288:vicw4w2Vb0zq6k5Z2mTmjqkGXNrGHORQuBT:viSwub0W6LmTSwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554272, "uuid": "ac3a2248-b7f2-4ccb-bd3e-725c21ecb0d2", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554272, "uuid": "887ca894-cc61-441d-a0d4-60994f30a39e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554272, "uuid": "c444372f-689b-4679-97a2-fe8d90213927", "value": "4a146dc48c5747b8584b0b35964a608f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cca0eee-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554968, "uuid": "9bc9f083-dfb9-4ead-b7db-2f222b5b9b93", "comment": "Malware payload (Heodo)", "value": "67558e14bf85c546a9a77bc1b157019c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554968, "uuid": "a183b12e-954e-4b0f-b7da-6ea28b9789e3", "comment": "Malware payload (Heodo)", "value": "61dad50054d7e783fcc56beeeacb732574c09331ad224adfc405c44d7491ab02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554968, "uuid": "73e00124-88fc-4d8e-856f-e3ed09f530be", "comment": "Malware payload (Heodo)", "value": "23bff30b5cab49117b9591caae27b55d191b0f7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554968, "uuid": "eee236b3-9754-431a-980d-adffd6823ef0", "comment": "Malware payload (Heodo)", "value": "773c160698b89234ed9a2aa86d75c6b5603e0c9073fcbf107c79d71d59069991752d8b7d07b458e4dc2686e1131ef1b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554968, "uuid": "c759106a-9ebd-4984-9eb5-96ce1de7418f", "value": "T16CA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554968, "uuid": "9567cc33-4d95-486b-8e0e-a46dd8c62265", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554968, "uuid": "4a330721-3705-418b-b8b2-f03101cb6d77", "value": "12288:vicw4w2Vb0zq6k5Z2mTBjqkGXNrGHORQuBT:viSwub0W6LmTnwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554968, "uuid": "12da2cf6-1f10-4134-9df1-7eb085124472", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554968, "uuid": "0b49ddae-9f99-4f74-a334-568b8c921e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554968, "uuid": "f9d87a4a-c0b7-4a1b-a828-45d0196d6810", "value": "67558e14bf85c546a9a77bc1b157019c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6c1e66-93ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645512853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512853, "uuid": "38199db2-13b5-43fc-85bc-2708e5b910df", "comment": "Malware payload (Formbook)", "value": "e26c1b1406eb785bb2967bb118ea7c94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512853, "uuid": "d94d4b2d-cadd-4932-bce2-bdb6a2f2d596", "comment": "Malware payload (Formbook)", "value": "620376e4bbb28e2ff3c82427767153500ed1c55b8c20c565084940514b33bc9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512853, "uuid": "1c9d1615-bfc5-46a4-bef1-091555cd6e1a", "comment": "Malware payload (Formbook)", "value": "73d21bad6957c4daa01d0f0985e0a7d7195dd24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512853, "uuid": "57c045c1-b3f6-4c21-9a4f-9ffc5a84277d", "comment": "Malware payload (Formbook)", "value": "1325dc17fcfe00760a75fcda791c332647b5460afa31f647704bc0007252ed7f9c6c856ec30f7fca963f937d44e00cb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512853, "uuid": "158925d1-ebda-45aa-9332-9aafc6f39586", "value": "T19B05BF042AA70F3DE1BA4BB249C4EC64FBA9F7235D18F37D7C512196CA52B408D4267B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512853, "uuid": "0ecfa1b8-9eef-422f-b03b-1499308d0742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512853, "uuid": "5c42daa1-e56d-4c97-bb49-334dfbb9e624", "value": "12288:egB6A2Ngh7jiNvwWevV8WnUHzzMnBkHsS7uLF4PyivGxhL5DmX/+lI2:d2Nzvw0pyMd+VmX/89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645512853, "uuid": "7e175a02-1aa4-494c-92a3-876ed6d92d1e", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645512853, "uuid": "278865cd-0961-40f7-9663-9fdb86f99534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512853, "uuid": "9d53d547-5c02-4c2c-9736-9ea8b74e05ac", "value": "QUOTE REQUEST_PDF__________________________________...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1de504d-939b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645505799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505799, "uuid": "02f70c40-72ed-4c08-87b9-8cf36ab3312f", "comment": "Malware payload (Mirai)", "value": "b2d30c78eff4e400a3ba7178ada95972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505799, "uuid": "95375555-0ee6-40c4-a9b9-fa7a6406bdf4", "comment": "Malware payload (Mirai)", "value": "628162900fe7256caf594f7196396b79bf70652d994ea3c5d8b734f5f674452b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505799, "uuid": "e51fb580-2c8f-4123-ae6f-3bf7ec5cd15e", "comment": "Malware payload (Mirai)", "value": "be62952249dac580ee4ee4d0f4c11fe6a7d4dbbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505799, "uuid": "40de9934-ad15-474d-a735-099ed1a67acf", "comment": "Malware payload (Mirai)", "value": "c01741284dd991dcbcfabc72c02deedea6a08c0266d4520236889adf4b79842ffbf9e94dd547e180e05076c17eeab779", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505799, "uuid": "7f480f00-cb2b-4f13-a166-9a9e0fcd947c", "value": "T1D0D2D134611A4C71F53B52BB6F9B5BE20A300FF1A007DE8E6514F9A54E5613438E7FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505799, "uuid": "c9cd2bc7-8b1a-4fbc-899e-f510ea667d27", "value": "768:rMDLeK8Yp2j4Jw9xB3YIx9ULOS5ocJgGlzDpUYsU:rMD58eC53jTBUVqYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505799, "uuid": "63eeb4cd-74af-4dfb-bd1b-9b48d89f4d5b", "value": 28816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505799, "uuid": "26d9f039-a0ca-4b80-ae01-72567c0bf37e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505799, "uuid": "ebea1bee-26db-4a02-9cf8-9da5f11572ac", "value": "SecuriteInfo.com.Linux.Mirai.1288.7091.9975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5bacf6-93d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531078, "uuid": "b553605b-1ef2-4b93-abba-818ccb60f527", "comment": "Malware payload (Mirai)", "value": "363996cde0e4e95c2efa4b643959cbbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531078, "uuid": "83255a57-28f7-4e65-90c4-d400f23e5449", "comment": "Malware payload (Mirai)", "value": "6288969970032c27ae916d43d2a222e8c091cc32dcde27592f4e060acac360f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531078, "uuid": "762908fa-df19-4bc8-9453-08c6443e57b0", "comment": "Malware payload (Mirai)", "value": "adbfea3f8aa973d747289c45c1a1cfb3a0eb3733", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531078, "uuid": "28692f1c-a21f-4445-87de-415af314f610", "comment": "Malware payload (Mirai)", "value": "94b631dd7e4d2c3d92944bf8e49901f76cfa2b30c475867a9cff06c1b1d423c9e80291e33576d7df2f37ea32fbcfb208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531078, "uuid": "89f29b19-6ba6-40a2-a353-5db8e7efc0d9", "value": "T136033A48B792E6B9E94091B510A7EB397E38FC3A10D1EB0FC3A45E7EE835420D61725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531078, "uuid": "f9371d8b-d1d0-41ff-be9a-b7d3335ca0db", "value": "768:pIaF41ZQY6I1qXIPiJkeftMXKdDxdJ6MvPZK8X+6PMXkmn8mSPxXJ4r2tG46:phIkI8tMsdznZKh6EiHtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531078, "uuid": "30e8c442-2439-4872-8c4b-af5da0050a30", "value": 41408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531078, "uuid": "60e1c1c7-0ce4-4ff1-825d-010cd273b8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531078, "uuid": "be912bf9-c82f-404e-96f5-076a10bcfd69", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a61ada2-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517597, "uuid": "664804ee-8a06-4dd3-9a71-74bc4c1ac854", "comment": "Malware payload", "value": "379cdd96491f9c0f528fd2b7aba87221", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517597, "uuid": "d8bc0cfa-ea70-4498-a423-6cbd11087fba", "comment": "Malware payload", "value": "62b692be251feb63af2723a68975976b749cab20014ffaa6488af80f4f03e0a1", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517597, "uuid": "083bcfcd-a878-4982-ab33-454028cc2f47", "comment": "Malware payload", "value": "9b9bd0f0dff324cf719bd053faa149773d7c4a0f", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517597, "uuid": "f5feb53a-a871-41f2-a301-ba1c8a2afe21", "comment": "Malware payload", "value": "d58db39e3df98fa24b299b528b3eb8371c547e1ac9b41700732522f184d8997c1b6769d1e1c9a33edbc8c846a566e653", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517597, "uuid": "0f0ea61d-9f47-433e-82b2-8b460cd28657", "value": "T1F8B4AE0533DC4A6AE2FE4739D4B79260C3B2B815693ECB8F5D8424EE1D26780D911BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517597, "uuid": "18cd6178-bfba-4635-aab5-a2ccb4454a7e", "value": "7f4e13350d4b328604b67db8b2b82979", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517597, "uuid": "5dbc2d34-8aa3-446f-91af-806f3e64015b", "value": "6144:yWp9teSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IYWz:yWpeJBdBS4msNUCe65frHMnz2R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517597, "uuid": "36b905aa-6b73-4786-8712-9bcf0fb67ad2", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517597, "uuid": "812a124c-277a-4fdc-b23e-6f552294bf11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517597, "uuid": "3af624b2-6997-4304-ada5-d9e0d045d658", "value": "62b692be251feb63af2723a68975976b749cab20014ffaa6488af80f4f03e0a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762107ef-9402-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645549883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549883, "uuid": "d9091d87-6700-4bc2-bef0-0c13cf33c7d7", "comment": "Malware payload", "value": "adf82786199fd5014675f8b5450cce16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549883, "uuid": "17a5bf1e-95c3-46ea-b9e5-d0d5ca4f7bcc", "comment": "Malware payload", "value": "634d84758d8d922bbfb0ad3c904c38fc7989f11503877acf02ad5dad3775df7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549883, "uuid": "e10f0aec-1588-49a6-bbdd-1e882a2dca2d", "comment": "Malware payload", "value": "5fff4c7c46e9d43682b3f905b67e01a666ca042d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549883, "uuid": "599a196f-6725-40b7-8155-33a20693a9e4", "comment": "Malware payload", "value": "02d4258fab25a72be4500cb3309adbeeace26e0e27fd4c56931bf637a6ca2f546049fc9e4250ba4845d3456dc94707ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549883, "uuid": "2013c70f-fab7-44c8-94f8-3c7e8bbb401f", "value": "T1C6C47C10F262F271D46399F44A7DAE76952C7D340B2457FB73C82A295A395C08B30FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549883, "uuid": "db358c05-fcf3-4f0c-b98d-3817794f6b8d", "value": "94a05edd536770f9e1ec8c773654f3a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549883, "uuid": "227a8e24-014d-4bd0-933f-7bf2d6f0b94b", "value": "12288:PyX/Gc6mBG6Lg9PNPjvrdY0YZa2+OeO+OeNhBBhhBBKfsDENv5c+QgMJu1sssn:PyXuc6mE609PNPjDdYpyrPguy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549883, "uuid": "48d490b1-3056-4101-a92b-34b495aa3f1b", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549883, "uuid": "7070d49b-3c58-40a0-90a4-a728a2133e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549883, "uuid": "67ff0a07-86fb-48f6-9143-7532795d6ec3", "value": "winlogin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8381a76c-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564938, "uuid": "e191df7e-9147-4952-8df9-b73d5d3d2d4b", "comment": "Malware payload (Heodo)", "value": "8c537758245177707b8da5f24930e28d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564938, "uuid": "ee655ff5-a1a9-4694-8102-30ed9a386c1a", "comment": "Malware payload (Heodo)", "value": "647fb82f392ee831344071108ad2c864b6ac29cdf104c75d7078510864f30206", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564938, "uuid": "cedf1f2b-e8f4-42bb-895c-d537df78e744", "comment": "Malware payload (Heodo)", "value": "aca010a45daef5d46f77f5432c03fe4d13ea1d66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564938, "uuid": "dd5b1e23-d038-4209-b872-1229bef06495", "comment": "Malware payload (Heodo)", "value": "4cd5ba779339b83ecfdc607ca03caa0880cf0b704927ed8188a5829ad45688c9200cc4c135b32d9fde49eb7adc236227", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564938, "uuid": "dadc3dc7-6042-4b16-830a-36e90cfe3b7c", "value": "T14BB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564938, "uuid": "bac99c55-760c-466b-9dcf-55cfa9c2a628", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564938, "uuid": "beaa32fc-a3eb-44a8-a642-f3dde99a8b8a", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wIIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWXzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564938, "uuid": "f25c25c4-69cd-4415-8c9c-b86f7b22c0e5", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564938, "uuid": "2bea8641-124f-4284-8920-3d049613669f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564938, "uuid": "340ee2f2-dbab-47e1-9d0f-8008e25f7c1b", "value": "emotet_exe_e5_647fb82f392ee831344071108ad2c864b6ac29cdf104c75d7078510864f30206_2022-02-22__212213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8329f802-93b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645516404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516404, "uuid": "a23c864b-f4c1-486c-bdd4-e2db41af83a1", "comment": "Malware payload", "value": "74574954498f36225b95cb94bed35716", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516404, "uuid": "a0df44ea-0401-4cdc-906c-ce79ef6ec48b", "comment": "Malware payload", "value": "6517dbbab588b7674f4e7a7f516d7abf1072875486719144ecd84d9ad9abb71e", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516404, "uuid": "1f70a77a-49d1-4ea4-8f5a-5b2fedb9082a", "comment": "Malware payload", "value": "28d522537c4e5134d9df7701354727659fa02751", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516404, "uuid": "6ebf8b52-1799-4edf-8fae-ac2b3427dd4a", "comment": "Malware payload", "value": "6fa7cea61feed8805ca21eac39d63666ff7782e9c4e9a1861bc1fb849392d91b45601582c86cb989d2ca5fefe979bb59", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516404, "uuid": "9b202d37-b2bb-4784-a47d-edb3f32ce7cb", "value": "T1EE23D01CC5821205C5B3593EC47888E41A67CC17B51588CFE1EABD8B47E9D9B278FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516404, "uuid": "a7c54a78-ad46-445a-b240-c7672d713f2c", "value": "768:N+QRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTZ:N+CJqHt7NJECQFfqAcSJ/bRS1/K8NytT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516404, "uuid": "76414390-9919-42b9-aecb-2bfd76ef4462", "value": 48023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516404, "uuid": "5d1b96bb-4511-4738-ab74-caf775b2a75d", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516404, "uuid": "34229297-78d4-4273-bd65-24b11394ec25", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dae677c-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554915, "uuid": "0e474d6d-46aa-49b1-97a2-f87c7359485c", "comment": "Malware payload", "value": "41d96aff56241370d0853171ca1f2ecb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554915, "uuid": "78923720-f216-4fd2-abdf-32ab72a9c014", "comment": "Malware payload", "value": "656996f3389954976b698780c5d0cd95a1ffcc981bbf9090dace81a7d9b3983d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554915, "uuid": "68765452-da2f-40cd-9a83-5ae1f427a397", "comment": "Malware payload", "value": "7edee1edd02ab686195b7baa055e08f7729251d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554915, "uuid": "869bf503-1f15-4731-9a5a-da2463bfb0a9", "comment": "Malware payload", "value": "cda38b6f9c8623e17891f8e5ebfeceacb45aa3838e7be726ed8e95a4e7440bbc6cca731e29aeaff48d11cc6204d6aa7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554915, "uuid": "1cef8973-933d-49ff-a654-43ad7cd530ed", "value": "T15BE27D92C81C6E94D26E52B5B9284E395713E806A3935EF72287CB5C8443FDCF9253F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554915, "uuid": "6da31f89-c607-4939-b7a6-a632d86c6735", "value": "768:/P30K/KFt+wkPaAfXNPXIPoCwoPGSZJV1o:/P0K/KfvFAVPXIoYPtJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554915, "uuid": "27750b21-7b98-4f80-891e-d3a272ee362f", "value": 31816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554915, "uuid": "ff4838f7-da22-4052-991a-ba4baca51194", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554915, "uuid": "456ee826-bd52-41db-8974-82cdceb17b43", "value": "41d96aff56241370d0853171ca1f2ecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bae9664-9385-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackCat)", "timestamp": 1645496259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496259, "uuid": "310e82a0-0664-4983-a496-90d410620e85", "comment": "Malware payload (BlackCat)", "value": "cf2264987cc01dc8d3f72027347a968b", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496259, "uuid": "c2a9eef6-104b-4caf-bc04-17cb642d6412", "comment": "Malware payload (BlackCat)", "value": "6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496259, "uuid": "de043bbc-50d4-4855-b3af-bb4d1dfa805e", "comment": "Malware payload (BlackCat)", "value": "3d385b316df5d37d39b10113a67080fc1516e0c9", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496259, "uuid": "45e6fb18-f26f-4281-818e-7311bb2c4e3d", "comment": "Malware payload (BlackCat)", "value": "ca5057e1566a20903258298046ed4a6853b84ea1588a98ad5f50dc09d9fe383ec20909ff3a23e44c1ef0cc8523a3fee1", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496259, "uuid": "01a5f676-8bbe-411c-b5e1-0845a74d92f9", "value": "T1C2D59F46F693A2AFCE5B1570306E733BD638481E0219CE63EBD85D217A2E7315E44E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496259, "uuid": "3bc2d1a7-82cd-4d9f-970e-9349a4e20c3d", "value": "676f66b42797477a467945daedd979f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496259, "uuid": "b09df376-ed95-43b2-b388-cbbf3695be6f", "value": "49152:H0z5TqmuGSSJLiqwRrYqFrjsAkJxyNuN/RgaJ2wp4:OVh/xGDCbJPvwwp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645496259, "uuid": "99e56c65-88fb-4c59-ae22-4da0c18574ab", "value": 2994688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645496259, "uuid": "0e633215-bdde-4888-b4e4-da2a502f92e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496259, "uuid": "4470510c-df69-4299-9eeb-e9bf83759c53", "value": "6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640a332b-9402-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645549853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549853, "uuid": "f62ffd60-9719-40d5-95a8-4e5b0d8c1498", "comment": "Malware payload", "value": "d9709acc21de3cb19f3ec95d5947ae07", "object_relation": "md5", "Tag": [ { "name": "EUROPOL", "colour": "#D59656", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549853, "uuid": "d94b0e67-c431-4438-9f8f-6113a496fa13", "comment": "Malware payload", "value": "66aa6936746711b3f56317090c07fdc03633bb8104b2b2acda44738602bc06d5", "object_relation": "sha256", "Tag": [ { "name": "EUROPOL", "colour": "#D59656", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549853, "uuid": "9470a4ab-36d3-404e-94af-f233ef83cb5e", "comment": "Malware payload", "value": "32cd827342344dd789086d11c2c91b32ddfc8e25", "object_relation": "sha1", "Tag": [ { "name": "EUROPOL", "colour": "#D59656", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549853, "uuid": "2e5d135d-5901-4340-8261-fb0e58b01811", "comment": "Malware payload", "value": "59966c8cb38879cf3c326b1a041e3c42eb8de767b20164b40cb12688400b79e0e16cb48970638e5ca57962660fa5ae1e", "object_relation": "sha3-384", "Tag": [ { "name": "EUROPOL", "colour": "#D59656", "exportable": true, "hide_tag": false }, { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549853, "uuid": "57330f7b-ccae-4887-bd58-cce246caaa28", "value": "T132D3CF31F1D3BC0EF947D6FA54A83B91667CB1B26AC87452186C8109A3CACC4FE726D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549853, "uuid": "346931d7-25c1-46d4-a353-46abbfc18db3", "value": "3072:h9dC2B+0h7Zb9yq3pXcmCf5Bsh9ioFgz7NVFGTS2t7TML:hnC2U0h9k4pXcp5By9iYQNVFoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549853, "uuid": "8f877992-e87e-468a-a888-304cdcb37ba2", "value": 132552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549853, "uuid": "a2eb499b-dd4f-44f5-a876-6a2cdbdded5a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549853, "uuid": "6d71d3ca-2294-47ce-9756-862916fbfa38", "value": "CONVOCAZIONE Polizia postale.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36dcfbb-93c1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645522095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522095, "uuid": "a733014d-453d-4f65-a6db-a6d0ce4dfadb", "comment": "Malware payload", "value": "50fffa4ed80d6a5ccebce12eb0b3e8a9", "object_relation": "md5", "Tag": [ { "name": "#joker", "colour": "#B52056", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522095, "uuid": "5ee2827e-975c-4eb8-9ccb-0c16ce3b0b11", "comment": "Malware payload", "value": "6716dd4b490403fdf23361bbcdca9283d2be8f1bdd65b7d7346cbeb03165036d", "object_relation": "sha256", "Tag": [ { "name": "#joker", "colour": "#B52056", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522095, "uuid": "31618771-6bfd-4833-9402-4b9e246f648a", "comment": "Malware payload", "value": "234e4aaedbbf9c240e79a639cc5b8b43a797a4d6", "object_relation": "sha1", "Tag": [ { "name": "#joker", "colour": "#B52056", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522095, "uuid": "7f116fa1-e60f-4a9a-bcd5-c993970fbdd7", "comment": "Malware payload", "value": "2438a293035cc0d016516d9b0932c391d407b14bae3b6c1f284d2c6dcf91fbb9590d2004480b69e6587de0769fa50d3d", "object_relation": "sha3-384", "Tag": [ { "name": "#joker", "colour": "#B52056", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522095, "uuid": "3a4a7946-404f-47d8-93c9-64cc7264b3d2", "value": "T1C8361287E31CA4AFC5B721328E7B126116974C6546C39BE72E59B62C1EB7AC40F49FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522095, "uuid": "ed6e5c45-99a1-45dc-a1e2-9cd17c6d13ef", "value": "98304:6Q0KrtXWcW2ZrP3OViFvLTLHQXdmckHxCEK8NjH3lH1r+K8DjviagAyfwrKmQ0VJ:6QRxjt2VCvLngmcKRpXlHkKKjgAyfwrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645522095, "uuid": "cd035551-cda6-4af4-8cb1-928cd72f675a", "value": 5246888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645522095, "uuid": "261ab72c-c0ca-4409-b019-d45c7a75e90c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522095, "uuid": "20c8e7ad-3479-46fc-8c9d-454c753e7a34", "value": "Simple QR Scanner.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de74b2b-93d0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645528394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528394, "uuid": "42b6e86a-81c6-4ed4-980a-27d95805849a", "comment": "Malware payload", "value": "8f928af9c3a8ce4244556aaf3ae31b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528394, "uuid": "f288b976-aace-4016-8108-22b7eb8fbd33", "comment": "Malware payload", "value": "67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528394, "uuid": "594d9621-ab10-4918-aa09-52d70ba2edcf", "comment": "Malware payload", "value": "fb31747726a0d1f451c73924be06d9b96471eef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528394, "uuid": "5e77b177-dbc0-45d2-b1c7-4ae1f780353b", "comment": "Malware payload", "value": "89d3c0b6532d389f5d6e7f07487e07fa64f34c8f7753ee913e62e3ef8ecedd7ff59d7414bdef84cfc5b72bb4d1943b95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528394, "uuid": "1e164945-0dc6-4bee-a066-e5e5151a8eb8", "value": "T191946C836BD45295EC3AC831DC3745610622BCBDDAD09BDB99C8F63D09702D0993EE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528394, "uuid": "c3422e6e-ed9e-43ee-9f24-014e817c24f5", "value": "780c0a4fd41d30e41aa9f2cc9b9d4728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528394, "uuid": "c3a8ef57-a220-4762-9c82-333eae5c2e2c", "value": "6144:8LbYOOIAdWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:UwIWW2KXzJ4pdd3klnnWosPhnzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528394, "uuid": "7da6c475-8f4c-4bdc-b5a7-6e7caa79ac26", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528394, "uuid": "5b54ca30-1240-456d-a377-0bccd182f243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528394, "uuid": "ad399190-6c68-42fc-91c8-96b15ac84a7b", "value": "calcs.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0521a4-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645513928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513928, "uuid": "a8b69f2d-06b6-4a04-97ae-ccff729e1b79", "comment": "Malware payload (SnakeKeylogger)", "value": "857f616b3a65cbf3a4dd2fc566c659cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513928, "uuid": "1c5578b0-d414-4759-91b6-43c6bc6917b5", "comment": "Malware payload (SnakeKeylogger)", "value": "67784d22999926733d9461e2884fbbc19833706958db7d9d4b27ce2e903f45d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513928, "uuid": "28eea77c-e291-4fe3-84e4-3127b0cb565b", "comment": "Malware payload (SnakeKeylogger)", "value": "5fe31f8628314647dba902998fcca9368cc1ceff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513928, "uuid": "08c8ea12-fc62-42a1-8904-45554a867151", "comment": "Malware payload (SnakeKeylogger)", "value": "5bfa80217852fa66229733a57e54c9cd07dc6c6863ff59ef6de13196eaa99c67d35a08f44a5e60596774761e7fb9ab2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513928, "uuid": "72ea7f81-b019-41e3-8131-2a89b366a84b", "value": "T11305BE043AA75F39F0B94BB649C1DC64FBA9F7236C05F37E7C506586CA52B408D822B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513928, "uuid": "d9f2e3be-ae7c-4370-a7df-2cdf03ca70e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513928, "uuid": "e75434da-a49d-4173-96bd-0db3080c948b", "value": "12288:bgB6P49GNUh7j3ZKFMgG9BH2YUkYgtEzGHPAYGKQKPEhBznUf6B4S5lHOIENQWBk:v48N+nn6i8G7GK5M/7KQlINq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513928, "uuid": "68164e43-dd4f-4d70-a514-f3c775ff390d", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513928, "uuid": "5d85c621-65e0-4cd7-a799-37c05d4efb2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513928, "uuid": "59f8b4f4-8e2a-42be-9c3d-e61a44b9cade", "value": "857f616b3a65cbf3a4dd2fc566c659cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e6b219-93ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645541637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541637, "uuid": "b2c0a322-ced2-4ec4-bcb6-eb17852c2f87", "comment": "Malware payload (Formbook)", "value": "52b704a5b91990616f13578732a79b97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541637, "uuid": "996852af-0c5a-4ed8-912d-1bf3928eb1a9", "comment": "Malware payload (Formbook)", "value": "678f04893ab76acac51db1dbfc38aa7b5bc442055e00d6f4dbc209e8d065b086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541637, "uuid": "c5c0374e-e8b2-4e9d-956d-8ecf6ba3d923", "comment": "Malware payload (Formbook)", "value": "fd6c83a29b70dbe8fa9dbc5971ec03f403c5061e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541637, "uuid": "5bfd16e5-763f-43d7-938d-babadc50b0da", "comment": "Malware payload (Formbook)", "value": "95baf993b13b702ea2b496b32b99dd7e01a4c5fc4095aed24e549bc6b2947707f339a8f1f2989d229c479ce90e4b8e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541637, "uuid": "667c6dd5-8508-460e-8311-cbbc366f03ec", "value": "T1E7D2C5749399E632DA54793A9A566B08333CDE018CC7CB27784C7F1F9D22140A6B33E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541637, "uuid": "7a023c5b-3d85-469b-afdc-4a306ec44a2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541637, "uuid": "29d073e4-4378-4457-8710-cd431ca718e1", "value": "768:cAZtb5Knps4nMWp/jI4XuMI/86nOa6TP4:LTb5ysL6o186OaC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645541637, "uuid": "332fcded-ed04-42a6-b4bf-86833dcc54f9", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645541637, "uuid": "f3843bce-1ad2-4a2d-bdd6-5e8a925f1268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541637, "uuid": "9c1b6a8e-8b72-48df-b10c-b8c4ae100a80", "value": "order confirmation payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55a8b04-93ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645512650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512650, "uuid": "4295c280-ebe7-452a-b9ec-e7ab43885340", "comment": "Malware payload", "value": "ee83d5167915f613ec07eb790c67dc46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512650, "uuid": "5cd8f272-dc1e-48cf-9472-77921185412c", "comment": "Malware payload", "value": "67a805ddbea42c37453199db24dff658074a1dcb169d36df988abf73b4ff602d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512650, "uuid": "7f6904c7-8efc-4401-b412-94e649c3891a", "comment": "Malware payload", "value": "41fbf53071f26270ebf3b4761a21d6532fe712ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512650, "uuid": "9294a697-8235-4bd2-a33f-2c0ec9fa30a7", "comment": "Malware payload", "value": "2ea73231843226c7bc75fb40ea2b3e7cd7ca8f83a7011992f698a24b38cb5eaaf09100bf4be81f53126bdf3035551fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512650, "uuid": "b5a533de-5b7f-41f7-9423-2f04313f2065", "value": "T1E0C1830B921808E2D509CFFA037B886C5F346213069053E2E8BB9C8DDEB2B1579132CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512650, "uuid": "0fc06e4b-ae3d-4fa6-972a-7d2f6a326603", "value": "aefcba7490330c41030899902fac777e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512650, "uuid": "cfccdca5-52eb-4b30-94dc-1fdabaa6f2d4", "value": "96:5IQlQ1/grpgjAZG3b5Os6Edfq/VhB9oPOoynKx:yQlLqJL0bE1wQPOoyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645512650, "uuid": "d87c5852-a6f4-4dcb-ae57-3697d295d438", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645512650, "uuid": "ee3d9c87-4695-472c-bad4-f0099813584f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512650, "uuid": "9a9aa865-588d-4998-87dd-36a5de1c1216", "value": "zervhatje", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910f667e-9385-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackCat)", "timestamp": 1645496241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496241, "uuid": "f97558fb-2394-47eb-b36b-d09f48391569", "comment": "Malware payload (BlackCat)", "value": "07e71cd54f3ac00b2a34c7955e5c41a8", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496241, "uuid": "08f2cd56-ae30-4220-a8c2-0498fb339bbf", "comment": "Malware payload (BlackCat)", "value": "67d1f4077e929385cfd869bf279892bf10a2c8f0af4119e4bc15a2add9461fec", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496241, "uuid": "aaa69bfb-8e50-444e-a567-0c5777cb8295", "comment": "Malware payload (BlackCat)", "value": "75b6eb3cc65a608abd9a96a3c5d158c944aadb15", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496241, "uuid": "8b33bcb5-b62f-4c39-8eca-8f960b563852", "comment": "Malware payload (BlackCat)", "value": "220d9bd28a015aa38e759adec9539185d50d242ba6bcf182ef362faa0f8bdc4ef9aa6d4acb0aeef6ddc652e6ac946943", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496241, "uuid": "3df1cde6-bcc1-4411-99a0-7164a3c885ba", "value": "T12AE58E47F98356A9CDA71A70305EF33AA6314818452D8EA3E7F8DD207B2E7105EC9E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496241, "uuid": "f5bb30ca-7381-40cb-a25e-dd28aeab6b20", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496241, "uuid": "a60dc48d-60f2-4603-b3e2-2a16cde0b69a", "value": "49152:HFyDutqkpj1TFUoXhjEjHjTu5tCeOZobIMfutoqKNd/RgaJ2weF:HFyDkNLXVEbjTuieOaR2+5vwweF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645496241, "uuid": "c50b1448-fd2c-4a3e-9892-0b19474fff7b", "value": 3081216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645496241, "uuid": "6ba1a165-e023-4a9a-807d-ff3a84a472d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496241, "uuid": "c22c2786-5484-4003-ac74-66dddd70ca8e", "value": "67d1f4077e929385cfd869bf279892bf10a2c8f0af4119e4bc15a2add9461fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d78ad9-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492065, "uuid": "7fdde062-41c1-4c57-a109-1a6bf104077d", "comment": "Malware payload (Mirai)", "value": "7493adf367f1eda159adc13c13d55018", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492065, "uuid": "536e56b6-8375-46e3-b2c8-3a8b9993608c", "comment": "Malware payload (Mirai)", "value": "67ea5e9eeb266c603ac7a2deaeaf3b0bcfbffc87992ac0708c08f5d6225aa8ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492065, "uuid": "1fe35e81-6ead-44c2-a490-d784da4876ae", "comment": "Malware payload (Mirai)", "value": "9301826e4520ec6642f4a5b20a8a4f3e216ad810", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492065, "uuid": "d503bbc0-5907-4855-b349-8edfef84cbc4", "comment": "Malware payload (Mirai)", "value": "c23723217db6d990d0a064a0c9bab3e6977f11590a711695b49f6e2341a747c5967133d8825a3e73152ebdba301767d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492065, "uuid": "780e9a7f-0264-40e3-9326-abaca9890e35", "value": "T1DB835DD6B801DD7DFC1BE77A4413060AB530A3600B930F36A61BFC97BC721A95A57E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492065, "uuid": "14b38ab3-8b30-4d2e-8821-9b5cda5f3ff1", "value": "1536:r5UkZHaBNGxSJdKEQ6/E8+3l6O81ALO0n331NleaLs:r5UGHMqSJsEj/68CLOuUaLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492065, "uuid": "1836c8db-3243-4fae-9bbe-1d64cfe27bbf", "value": 81776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492065, "uuid": "d0fee365-82a2-4f6f-a79a-749a075ced6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492065, "uuid": "57f85aae-f163-4e2b-9037-94faa4f88625", "value": "7493adf367f1eda159adc13c13d55018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc60f85-9375-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645489260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645489260, "uuid": "80a3471d-a6dd-4aec-8b1f-fe76e990d53e", "comment": "Malware payload (Mirai)", "value": "c3666b9ec5db1b1eec12e4c6429b667e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645489260, "uuid": "9ab4d352-14c7-49a9-a366-f42fc595d133", "comment": "Malware payload (Mirai)", "value": "682c46afe1932e68aab2e508a4830bd7d659e0a825a6b391b89bc3060c70839f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645489260, "uuid": "7fdf7c04-0070-4c36-88d6-d23ca4bc0fb3", "comment": "Malware payload (Mirai)", "value": "b24067af184bb3c54f46ef0cf3b52ad71be29ef7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645489260, "uuid": "6d491a81-2c3b-4493-b61d-9da470b1db33", "comment": "Malware payload (Mirai)", "value": "435baadaefb611a06db765ebbf9ec970fda137a9d5ba8325e25665fd7020e9a012fa71435ce1deceb970dea4b173d517", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645489260, "uuid": "bc075d64-9072-4d8b-8205-fcb5cc6cc93d", "value": "T17CD2E05DB78044AAC112C8B083D9532219760FF3B94FFC597C97EA5389868B574A32EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645489260, "uuid": "a95246a3-b5dd-475e-960f-6902252451f3", "value": "768:gHbKO/gkgnb5i/n1EbuA8+4iejlWpIr3grABM9WZiDlJgGlzDpbuR1Jq:tOjgnb5i/nqbudMjreIfVJuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645489260, "uuid": "3c4757de-01d2-4208-95e5-7b9241ccdc75", "value": 30516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645489260, "uuid": "28ece105-3b3e-4e41-a0e0-d46155bb7332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645489260, "uuid": "516505da-0b21-4356-a181-92ba7e8ec1a5", "value": "c3666b9ec5db1b1eec12e4c6429b667e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd28f3c-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554973, "uuid": "8f6fc7ea-3bb7-4926-9622-80b1f2ef828a", "comment": "Malware payload (Heodo)", "value": "3fc4c90657e84b2b33781c05a7c019ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554973, "uuid": "6fa1addf-5032-4153-9439-922cda22de34", "comment": "Malware payload (Heodo)", "value": "69746cc2a96c8e0079dfcd3147a5a3d6e665e01c74266979749e8a3c135a8574", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554973, "uuid": "2483cd65-421c-4058-94a1-01f18e7a4264", "comment": "Malware payload (Heodo)", "value": "95ec94c669e98798742752b003a64ef264df10f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554973, "uuid": "86bbad1d-79ed-48c2-a2ee-afbfa871e6e8", "comment": "Malware payload (Heodo)", "value": "b4d8c196eeb9812c10626d9fd651ce8390125333d720f0ecd23d6bd73797c201f71de9fa9710640f5bc6fb199e11feea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554973, "uuid": "d4a05d90-f1eb-4ffe-9f3a-b5ce7313f1d0", "value": "T115A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554973, "uuid": "9aa2128a-0d35-4494-95a9-e8c384327a5a", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554973, "uuid": "fed668fd-8a9a-4468-ac0d-94d945633190", "value": "12288:vicw4w2Vb0zq6k5Z2mTmjqkGXNrGHORQuBT:viSwub0W6LmTSwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554973, "uuid": "d9728a23-9011-4f99-9833-bf86fead1f09", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554973, "uuid": "54bbb0bd-f152-49f3-89df-dd7d97019864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554973, "uuid": "c88a1206-ddd2-4054-8374-606be822f347", "value": "3fc4c90657e84b2b33781c05a7c019ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37629ba8-93e7-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645538181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538181, "uuid": "c7baf0dd-a0ba-4b16-98c7-0d95a65e5520", "comment": "Malware payload (Quakbot)", "value": "a3d9ec0b1355db40a7f805503c521f84", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538181, "uuid": "cd4223e2-3bab-47df-becc-79267e9d85f5", "comment": "Malware payload (Quakbot)", "value": "6988c31a1211046a00837371dd0c28d3ac17d28370b2c3e88524ba0ee1d448a1", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538181, "uuid": "c296b88a-f79b-4f2a-a838-aa9af0823f6d", "comment": "Malware payload (Quakbot)", "value": "e520272b61f4abd49dc30a60f2f63f7f92531000", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538181, "uuid": "242defd3-82c9-4ac8-bc08-f966080cc60f", "comment": "Malware payload (Quakbot)", "value": "93ec8290b7f4868e948ca71d6e946b0ad08809aaa32c7fe2e7ef7cd9e9b0c7b8c37e35becae60efa25ff9a508a8ed18e", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538181, "uuid": "38e4adcc-d023-4fee-a216-fd05001cdbaa", "value": "T1A744CF829885704FEF1FE833CA57DBBAF089A574B472E0872EDF44E39E85342564570A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538181, "uuid": "ad58b8c9-d034-435a-9692-bd85872221bf", "value": "6144:YO4xg53oqHWu0000000000000000000qSfPhTD7ANHbA2UUUXWp9BW+:t8gvZw5UXTBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645538181, "uuid": "35bd5544-a48a-4874-87e7-5fcfd8611e72", "value": 270795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645538181, "uuid": "388bf271-8fdb-4246-83aa-0845a51c97c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538181, "uuid": "a83b2353-294a-4c4a-8613-9a6856a39c70", "value": "CP-188564934.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ffef5b-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554089, "uuid": "8c0063da-a3fb-4575-be92-05abb3e918b3", "comment": "Malware payload", "value": "a7d60c1bc0697ccda32ed343abac7cc6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554089, "uuid": "7bf17cf8-abd7-40d7-8fb1-2e68e019f83d", "comment": "Malware payload", "value": "6ad8013c03d6c4238bf38853e71907ad2d1a12b4e699adf803e0cba9822a903f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554089, "uuid": "df256501-ad2e-498c-a6c7-dc645730a6b9", "comment": "Malware payload", "value": "6057d5e8ba5dd3d51cd59c14ec145364074df99e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554089, "uuid": "5d944e08-445f-47a8-9b58-e87b8584db26", "comment": "Malware payload", "value": "dfb7dccfb910b1cb779acb73d629f36a1dfdb9fda1a982a9bb5a4fea817b67d784b24e3c2c9a4705a781965ddc582155", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554089, "uuid": "0aa1ad54-cb4b-4f02-b901-b53a27476818", "value": "T193930769B681C95BCA5807344CD7CBF67227BC424E7987473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554089, "uuid": "fe9720d7-2f61-4234-82ba-2311832a9737", "value": "1536:dyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQs4kWvgrPE4nWHPNc2AB:dyehv7q2Pjx45uoDGTj+5xtekEvi8/dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554089, "uuid": "8255d9e2-7b95-4af4-88dd-896230b537f7", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554089, "uuid": "e477b023-6027-4368-a87a-6473e3afbbc5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554089, "uuid": "a3b6633b-2098-480d-8437-75e589fddd8d", "value": "tmpo5_7hab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8158fbe-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645514453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514453, "uuid": "a17b1b13-1088-446c-b48d-e61410b37736", "comment": "Malware payload (Loki)", "value": "3203147d6fc79c406f694e0d646f4ec6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514453, "uuid": "9f249b60-f8aa-45d7-b49f-e1ecc948c70a", "comment": "Malware payload (Loki)", "value": "6ae870fe5e64ba4eaae037be457046b3d1fb4380198667f9b7a65be3638d73b6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514453, "uuid": "91be1a27-3da7-4527-a265-31ab7f8cad7b", "comment": "Malware payload (Loki)", "value": "6d438de6d8467d407e05f821d6ba8d68b633ddac", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514453, "uuid": "6ecea378-eb13-4771-8c92-d3f781120d76", "comment": "Malware payload (Loki)", "value": "802a64ce325c2201629827edf1277e7629aa7236cd1e13930ea3476bdc86c9d5783c6d8de12baef56c72f892731991c2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514453, "uuid": "7165a1c9-3502-4897-b2cb-4255073eeaa8", "value": "T1061412273E7FEF0DE36A297B9D52C8F1B93DDC91B8409102E48BB1510CB897045A7E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514453, "uuid": "37458c00-1cec-40bf-bc24-d9a46497b01e", "value": "3072:P/oGiLInN2fcyhWIxXgzA918uoDJaMPBFrT6EHQVKoQeVxND6woBdZnCEZXAtNay:HCcyhzxXgzBuoDfPBpT6EHQAoQeTND6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514453, "uuid": "425b1f51-d62d-4786-a2d3-c0aecbba9e0d", "value": 191976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514453, "uuid": "7c025d85-b1cb-440a-88f8-71f7b4267274", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514453, "uuid": "8cda753e-015d-4531-9095-31d54be46087", "value": "RFQ_Hua Joo Success Industry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f037f1d-93c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645523752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523752, "uuid": "0c3e4574-de84-4433-99e8-fe216deb878e", "comment": "Malware payload (Loki)", "value": "756f28c658719be56c7237075e7f19e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523752, "uuid": "f3201e58-6396-4db3-9fbd-c886057c7b36", "comment": "Malware payload (Loki)", "value": "6c6ed8512d6dae1feb7aeb88eaf3087456b541f22e5491614a37046707d9cfcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523752, "uuid": "bb531fda-2d59-44a5-9e5a-f170b4903c49", "comment": "Malware payload (Loki)", "value": "7cc0596a5c545bc7fb227adb55491ede10b9ce6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523752, "uuid": "7d68af93-3bfc-490b-bf07-ee09c24ab20c", "comment": "Malware payload (Loki)", "value": "4ea7fb0ea71f1ca186095201ef87559387e32d42506579218a0fd08456039b00736920735d7b556d3413f6020093cd3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523752, "uuid": "f2b55fe9-b7e8-4247-901f-cf74e6301bf1", "value": "T1BD242DC5E98465A0DD59AB716A37CD3542237EFDA874A42C28DE3E273FFB2931026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523752, "uuid": "04acb1e9-da59-4386-9102-1d5d208f67f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523752, "uuid": "ab1d3a95-8254-4b84-9ee5-b21bc67ae768", "value": "6144:HbPAkztmr9r/EDpppppppppppppppppppppppppppppb3:d5mr9r/+pppppppppppppppppppppppv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645523752, "uuid": "e98ed133-f662-48c5-b728-553b2325ea95", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645523752, "uuid": "edf21f49-0602-4322-ba88-4d68c8b7a109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523752, "uuid": "97446489-c051-452d-bf3a-e1519ca06ef9", "value": "Pagoimg309875493.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07249ad-93e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645535915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535915, "uuid": "c2a91b01-42ba-413e-91b8-75ea9b76320d", "comment": "Malware payload (Formbook)", "value": "e78e7ed1e52f0f034dbec1191c07b90f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535915, "uuid": "2182ca7c-5c64-4294-8a48-e4d92bb21c21", "comment": "Malware payload (Formbook)", "value": "6c7bc2a0288450e984898339f779daa67583a202427e894fcb55a8c4238daae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535915, "uuid": "c2d2722c-7c61-4e42-ba19-f93c3edab114", "comment": "Malware payload (Formbook)", "value": "401a776bca2a76c5973757b92005d64f9c0f8ff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535915, "uuid": "1aa882cd-90ff-4386-8f25-c88b7e99b160", "comment": "Malware payload (Formbook)", "value": "5343766937e2578e1aba50656303ac6ab38e996270ad0a7600a8bc775f924b0721b31291abd30303ceb78a112a8acf33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535915, "uuid": "12e00f06-61e8-4b4d-8ad7-2c1d64f71b72", "value": "T1C3354A9C365072EFC867C976CAA81C64EA60747B930FD203A05716ED9E0DA9BDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535915, "uuid": "3522a18d-6017-4e31-b013-1a6ec034b14f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535915, "uuid": "da13f18c-1205-4358-9574-db901767860c", "value": "12288:/cPrbgZ+xAiEYRj+dkcW/UzrhD5D/skrClGcqB23BKmb8pSEPF5w8mqXBMRInxOZ:EsguZG+dzW/UxDF/zrwBKmb8PFm8mqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645535915, "uuid": "7a1d6e96-b885-45f9-9cb4-458c4bbed770", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645535915, "uuid": "4db0f532-10d1-499b-a9dd-caa322d69037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535915, "uuid": "ae522da2-0435-4fe9-8997-a9934c73cbed", "value": "qvidqd1Bg0H6YxV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ada7ce-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518069, "uuid": "99aac20f-aa34-43b1-a488-570dbdf6cb76", "comment": "Malware payload", "value": "ed9d11100e8fd440381b55b1e1399708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518069, "uuid": "ab68b70d-049b-4556-b9cf-e0856ea02148", "comment": "Malware payload", "value": "6c9f4fd8bce7c5edba759d844ac32bdcdbf00c2e8685381fced92a1bc3129939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518069, "uuid": "3f4f6610-0c97-4211-a46f-d2297f5851c0", "comment": "Malware payload", "value": "1993e66afa664ee12d40d14f15de5e20acde0a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518069, "uuid": "d54178a8-8491-4ec1-9ae5-8a2355daa582", "comment": "Malware payload", "value": "f90debd30881146971f08e98e0e2a7e3cd664648139bfa21ba833daaf0231dc16a5dbe7e7b515c847744feac403f1d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518069, "uuid": "70ce0319-2979-47c9-887f-643d1af0015a", "value": "T143558D01F101613AF8B340BBDAFF592DDA589A71130D50E7A3D8A95E87A2EF23D32157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518069, "uuid": "62bacb84-db86-461e-abf7-fc8fc939fafd", "value": "24576:41DwfHlGOADy7Kq1H1GV328e82fhjlDP97PJf8TI:41DwvlGOADy7RGV3Xe82ZjhP97V8TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518069, "uuid": "f760259a-fc47-479d-ac6e-11921e0c782d", "value": 1364050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518069, "uuid": "5737df31-3a46-4d9a-bcde-6cd2953803b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518069, "uuid": "eb8aad52-f4f2-40ca-b9ee-2cf1c3c02755", "value": "ed9d11100e8fd440381b55b1e1399708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d475d6-93a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645509003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509003, "uuid": "9a5d72d3-2106-4d91-bc92-870b4b716cd7", "comment": "Malware payload (Mirai)", "value": "9fcec09cdd98a976ba54c3430469abd8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509003, "uuid": "abf1a787-678d-4711-aea7-0d42f8c1d586", "comment": "Malware payload (Mirai)", "value": "6d45e0d994ce25545f513fa4b385d2c003194f068acc8031a1c990d068dd6510", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509003, "uuid": "8e6f2818-6d5f-4690-9ec9-45d0807a5783", "comment": "Malware payload (Mirai)", "value": "114f34f3fac4bb44c3fd68a0f29bb2e89b343f1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509003, "uuid": "4127d67a-3537-42d2-8570-a50ba2ca01dc", "comment": "Malware payload (Mirai)", "value": "c91d6c966c22fb6e9afa09ae0e540db22c354455d5feb426e54a2ca1d11e6d36fc28c2812e8ef6b07632907de7b93f83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509003, "uuid": "084e06a5-2994-46e8-98a7-9a64a08092c5", "value": "T1BF33F27905669E84FA4F4A74ECF27F1947500118896D4EE09A8E1132FE89F7F0B3526B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509003, "uuid": "1b06f54d-6dc7-45b7-b6ee-1b83c3625801", "value": "1536:ZcRR+kum3hbgbqOx16kKIgovAkKIKwiV67HXnouy8Gyc7Qu:+RYkl3F/O/6lNKAkFgAXouto7Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645509003, "uuid": "b73cec3f-59b6-4a83-bf1d-8b295581415c", "value": 51968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645509003, "uuid": "3990fc27-275f-48bf-967c-588455a2aa9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509003, "uuid": "c022aefd-060f-49d6-b052-3eeebe3c7b28", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959dd807-9398-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645504409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504409, "uuid": "7912d96d-c62c-42c9-8070-eaf21cd9e08e", "comment": "Malware payload", "value": "ff386de9d0dfc1cf218d2b2fc69ab01a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504409, "uuid": "c7601d8e-6bc5-4337-ac3c-a99378bb8a45", "comment": "Malware payload", "value": "6dedb399e78089fc4b8e19828fe5a7176a2d55c8bf80404ac094ba408214c7f7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504409, "uuid": "fb03a547-b54a-488e-a0ff-07c062ea6978", "comment": "Malware payload", "value": "b4277232dc33293417f4bf0d9d1ffccb1a5529aa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504409, "uuid": "6eada40d-dc43-4e84-9588-e510f09df180", "comment": "Malware payload", "value": "00d1d81d501429903a0d8d18feb9d21ea0b7ee09da735cb519a69357b243b712726105afb59df5d6b4d28212f3778f38", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504409, "uuid": "c3c78100-de48-48d4-a02d-6ac05df448a5", "value": "T1FD41D63F4A99A6BF3016C8F2D7FD4F8D67622007B43534A3978CE96922B55A0CE21090", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504409, "uuid": "af5be6d2-a795-45b6-9b19-763a1be0090c", "value": "48:R+fAV7Z0A/VmkphC/V341z1XhmbEfAV7Z0A/VmkphC/V341z1Xhn:rvQftI1z1XhOvQftI1z1Xhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645504409, "uuid": "496ed40a-e69f-4aaa-9ed0-45c21067087f", "value": 2287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645504409, "uuid": "dae296cb-b0d0-44d0-a49e-25a4eb7e7fdd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504409, "uuid": "02106cca-9118-4dbf-aafd-ddf32a8eaf5a", "value": "boxter.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2adfec-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645516124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516124, "uuid": "adfe7955-5f7a-4d79-b07c-92c05bfb3c65", "comment": "Malware payload (AgentTesla)", "value": "ef012f2af986aba1f282f4b4ba094a1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516124, "uuid": "ec0523b2-86e0-4f0b-b505-10f8431ec103", "comment": "Malware payload (AgentTesla)", "value": "6e2c1783d043a360901610858e7469d1c667151d29e1cca0002db3bc131ccc37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516124, "uuid": "0488be0e-109f-40fc-9c4c-99f2a31ee202", "comment": "Malware payload (AgentTesla)", "value": "4fb3e5e46ac01434530845c45e47e0e6d6bc2192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516124, "uuid": "fafe1048-6f90-4fce-8112-c1e4cf62e638", "comment": "Malware payload (AgentTesla)", "value": "a96acecb8f41c75be7cc79e21c69cb279985959ff0cc2852ba0449338b4ae6e283e96554a539252716b892a883d8a289", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516124, "uuid": "c3c34907-e750-48e2-a63d-84db08537adc", "value": "T19215C0083AA75F3DE1B94BB258D1DC74F769F2236C09F37E7C51259ACA52B408C422B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516124, "uuid": "526f9cd3-ab47-4d04-bdbc-afd057a9495c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516124, "uuid": "7489e074-37b6-4dd3-8dab-4fe0e2d6b388", "value": "12288:fgB61RnDNIh7jQQwA1nbbuxtt5dcSW5Lg2nGJGBL6bdC2iM5QyyaWLg2tz:xRnDNrQw2ux50LSdDJLyaWLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516124, "uuid": "683823d7-b152-4f54-808b-7968e495b9a1", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516124, "uuid": "6ec4c197-a73c-4e18-bdf6-09e9a7ee53d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516124, "uuid": "aea758e3-db4f-46d2-bdad-e8c9d7324a80", "value": "Order_2202581PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fffb1bf-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645539082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539082, "uuid": "e076ed8e-717f-42aa-945f-979bdfc0e79d", "comment": "Malware payload (Loki)", "value": "6835cbdac6c029c81923f860e96f88a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539082, "uuid": "94044180-673c-47e3-8e54-6371e24ba5ec", "comment": "Malware payload (Loki)", "value": "6e6a12631dae3e01e56e786fa26bc9cb16f90910d9ecd6f59b0ad3237ce4551d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539082, "uuid": "2d9288ca-e9ff-4255-9e63-f3d09579bfea", "comment": "Malware payload (Loki)", "value": "da739f6af0ee87beb3b18a77141f49d49e5758ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539082, "uuid": "4cd23ed7-8069-4d65-bfa1-135c19419f82", "comment": "Malware payload (Loki)", "value": "2afd55c22e586b185c0c4ab21d43918078f2eee1e413f0a7622b08ca958d09f3e6593c18ce917cb7c42462adbe7c0c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539082, "uuid": "2c94fe72-6f53-4c5e-adcc-bd919aa7f5b5", "value": "T108E4CFDC38BA41F9E3268AFE9DDDE5B0CF7DE6212604E47979D91F164740B8488C2239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539082, "uuid": "87ac8559-3441-4af2-8bc9-496312afd6b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539082, "uuid": "fb60ce3d-4fe0-4d11-afca-9b3d10d6b804", "value": "12288:KR/Qby0chFFQWN87jf39W+qr8RG/H6Y3NaSKNtZsviX84p86SYauJKizWH7k53YN:KqbHchFG7jfkn/HZ3gJZsvisheauJKNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539082, "uuid": "6129f37d-dd25-4f81-92d2-77c7f4eebdb6", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539082, "uuid": "1dfc9219-a0b3-4360-b71a-0a5a65b3af96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539082, "uuid": "2ec34713-6d21-49d3-bc28-6039d53c6328", "value": "RFQ_Hua Joo Success Industry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762a703e-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518530, "uuid": "a4e50d2d-0575-411d-8542-1d140e705766", "comment": "Malware payload", "value": "b921f1f433015d3780e9c13ab245f2eb", "object_relation": "md5", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518530, "uuid": "d491e953-fe22-4d79-a12e-e950b8464f1b", "comment": "Malware payload", "value": "6e6bfcbc22644d060670718dea2c5a7d860edc55cf8bd6100e277e53a8b0fc92", "object_relation": "sha256", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518530, "uuid": "3f32f407-4864-45d7-952a-233ca794df4d", "comment": "Malware payload", "value": "cbc30251bb9392dc0c47b2b1084273c0aa58a0dc", "object_relation": "sha1", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518530, "uuid": "18057156-d8f8-4a48-858c-0d34d97e1866", "comment": "Malware payload", "value": "663e4cd63c62c3507b28f14447c935f130dca77eab14606ff56b5e82864e2f53435c8ace33951d294ab9aef47087b075", "object_relation": "sha3-384", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518530, "uuid": "39c95584-7afc-4c33-b8c9-52e5fd75ff34", "value": "T15744020777C555BBC71201302FAE3B8EE2B9A53964FDAA09FF91074D7A60453821BE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518530, "uuid": "efc367c2-6ca7-4a5a-8ea4-62bb1ff1d5f6", "value": "3c98c11017e670673be70ad841ea9c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518530, "uuid": "863ad1e3-3607-4863-b3c4-e0ff0d4bddd7", "value": "6144:yz+92mhAMJ/cPl3ieBLVcFtRbUN5T+ZjOEGdjPHZ17jsjnvlmV8i:yK2mhAMJ/cPlfcFnU6kdZsnvYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518530, "uuid": "b8614d01-d5f3-4540-832c-8e6701fc326e", "value": 273638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518530, "uuid": "7051aeae-160a-43ae-8af3-dd5c8d6fd93a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518530, "uuid": "5c31c0d6-ba4f-4f1f-a691-4ef9625a140c", "value": "6e6bfcbc22644d060670718dea2c5a7d860edc55cf8bd6100e277e53a8b0fc92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e100ec3e-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492080, "uuid": "52172ebe-483a-4c43-9966-e688a45d903d", "comment": "Malware payload (Mirai)", "value": "40241488f85285b9ea292473db97e181", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492080, "uuid": "2052996b-1d99-456c-bcf1-b7d3ea1807b9", "comment": "Malware payload (Mirai)", "value": "6ec81efe3490c5ebfbd353fad3313e0e05756d5517ae19f7d24623c552510bb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492080, "uuid": "5630e5b9-7e6f-4ee0-8151-8921b3ffc52f", "comment": "Malware payload (Mirai)", "value": "b056038340b6ed07f26f643d13124f6b50a3828b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492080, "uuid": "33fed028-62de-4c2c-a689-99712064184d", "comment": "Malware payload (Mirai)", "value": "5e5fd8ed9375917955c0c24ef6205038c16ae5fd683b047f203b067d2519128e7224896f8a31f25f9732ef30c9c7304e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492080, "uuid": "11a80471-5c07-4543-a3ae-e6847557977d", "value": "T16D92DF00940EA2B3D7F01972E46E810D3AA296ACDC9875EE6794325CEDC7495EDEE407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492080, "uuid": "84c33e54-4ec5-40a1-b72a-d5abb71c773b", "value": "384:ZEadh3luIDKo1lGV56SYgSr/cOmYEIXjwTmdGU5Ezit:ZEUl3Ko88SYRr/YkMT3U0it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492080, "uuid": "48dd10ee-2f0b-443f-8131-58bec97de54b", "value": 21144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492080, "uuid": "24ba4c68-5b22-4e88-8e7b-0901c8dfa342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492080, "uuid": "3b729f83-9d59-4b9d-9d06-109aed82b7bb", "value": "40241488f85285b9ea292473db97e181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb09f431-93f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645546240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546240, "uuid": "caeeaf41-2b93-4d69-ae9c-dc156bdb65b3", "comment": "Malware payload (Formbook)", "value": "bb4bd9df1d18ee2ce11500789a4ea825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546240, "uuid": "383a78f8-0142-4b89-83c7-ff29ab3856b3", "comment": "Malware payload (Formbook)", "value": "6ecfdff224175dade2cbf63719974b5335c1a81cf787142681163ddf882ce00e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546240, "uuid": "00463839-97fc-4c10-bca6-83153c69568e", "comment": "Malware payload (Formbook)", "value": "4e3f76d79d8c299e35199c8d251c97e954a4da2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546240, "uuid": "3addadea-3b16-4402-84f0-21dd3bdf09ef", "comment": "Malware payload (Formbook)", "value": "14bb18141b85d0b390b6d418b1a88cadda2a239a32b2cc2037ceda36ef6f5bd716982ba57c3122ddcdcb48833d0613c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546240, "uuid": "be0f1469-2357-4f8b-9281-b561d96276e3", "value": "T11115CF142AA71F3CF1B94BB249D1ECA4F7A8F6236D05F37D7D50219ACA52B408D422B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546240, "uuid": "47a5d7fd-76d0-4a40-b7a0-5696f95d52a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546240, "uuid": "c41b6226-9b0f-420b-9db1-9c327df9cfb2", "value": "24576:d+NDXuv+4uwiwBe68IaIVUxADmhZrm2u:+U+4uwiwBT8sVUiDQZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546240, "uuid": "a0fa095e-07ba-4776-8011-bf0f733979e1", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546240, "uuid": "d68112d7-bdec-4e35-9802-99a0433e78ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546240, "uuid": "cffdca57-388d-4c45-a688-464ac70fab19", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4d7c32-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528148, "uuid": "4990c2c0-7fff-4db2-b44d-30baac1fbca1", "comment": "Malware payload (Mirai)", "value": "3ebd7a4f33858decd068341e03aef86a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528148, "uuid": "dee26ce0-0e25-4655-9fb5-69b722e704fc", "comment": "Malware payload (Mirai)", "value": "6f173a360ad9b5ba310730898188df8fdee4c4bf0269b9754dde292166c31469", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528148, "uuid": "5b2b1187-76c7-4f57-8d62-b3f304239cc2", "comment": "Malware payload (Mirai)", "value": "1be25a30ef7692ad82e37748032933a2a9da80ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528148, "uuid": "2d190946-add2-4c20-9e9a-7214566c4fff", "comment": "Malware payload (Mirai)", "value": "99825169e9c3b53960f3954570be1c2fa2b73d8039cfd578bed8780c84fbebcb279185f0df7ddfbdc1eb1c95b409dca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528148, "uuid": "9bbd0da6-2eb7-492d-b0e0-7aa2ff901268", "value": "T1E273840E2E619FBCFBAD863587B34F209248339226E1D545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528148, "uuid": "5ec2d1e5-b7b8-45ec-8e2d-c43193493eda", "value": "1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXwHV85Aa9EJjzETm:B6ry6+vdGIdysUKX85A2EBzIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528148, "uuid": "a036dfd3-f63c-49ca-b0f3-9de7ae9c0411", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528148, "uuid": "41309d0c-4a69-47aa-ae99-36408a7dfc9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528148, "uuid": "52e58358-332a-472a-b561-a311315b34a3", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37af316-93ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645512646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512646, "uuid": "bcc15f56-09e9-4690-a151-21b04b6cea4e", "comment": "Malware payload", "value": "b23dd67d908318325555016bf652e288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512646, "uuid": "1215d538-f78e-4dfa-9032-8d33af4008c8", "comment": "Malware payload", "value": "6f55f8d4f012077d31e6464428b9a8a8a4a7fcd6cf77e73f8c0a8304718800c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512646, "uuid": "922862ec-ada5-4ca7-bfe4-b1b23e3a0600", "comment": "Malware payload", "value": "0e811a2fc54b4c89931feb118c95e27375a4ea76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512646, "uuid": "55eac3de-ea68-4786-8815-1795a86dea3f", "comment": "Malware payload", "value": "06dbf60a3922e90444d069d5f9697164840ecc7e5006ada6fa93f450ce6e5721a5586187a6cb2dfbd6c3cc0020f94be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512646, "uuid": "c3676454-edeb-4cc5-9746-709d10506058", "value": "T1B60560D677889FA2D81A52742D86C3963372FC705E63C7073599733E2EB32C45E62A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512646, "uuid": "e99beccc-73b6-42c1-bc08-ef4a5f39854f", "value": "3072:r+CNyL24hTRPsmnbCqxNIgvG4dWKRpQ7/zpBFGs:r+cyq4hRPsm2qxygvrWKb2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645512646, "uuid": "6edd3f14-ae0a-4c28-ae8a-98924d589330", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645512646, "uuid": "125f3419-6a5a-4c3c-9034-3722398a9c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512646, "uuid": "226908e0-2035-4cb2-a464-fc12cd304178", "value": "WAXAA7C", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f538c3da-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645517884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517884, "uuid": "024f8af2-add5-4dcf-a286-21aaa0ad7a01", "comment": "Malware payload (AgentTesla)", "value": "f774bc40f25488bc5c36917b7f86131d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517884, "uuid": "f71b9745-3622-4a6a-94fe-855b25b817a2", "comment": "Malware payload (AgentTesla)", "value": "6f6fee8de5a50e7f6fd1a594bf340453973a5ffb37aa2173ffdc0329e85e9b51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517884, "uuid": "021e9c61-71cb-40bf-998d-392d693df414", "comment": "Malware payload (AgentTesla)", "value": "d63467dd1c6795f52e83042633a6755fe4442f6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517884, "uuid": "a516b512-4597-47e3-bfdf-6074a804a06a", "comment": "Malware payload (AgentTesla)", "value": "68ce3b670e0d07b73c453417dab9480d943682bb905ef69e925e5e533eac71fe72da9cd352740cfd43f4134e92459cb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517884, "uuid": "d05992e8-5ca7-4fd2-87f1-ab067f5bdb0d", "value": "T17915CF143AAB1F3CF0BA4BB658D4EC64FBA9F7235C05F37D78505596CA92B408C422B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517884, "uuid": "d8b74d77-e8b2-4f9c-aa76-21621a60c4f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517884, "uuid": "897de5ee-5506-4175-966f-568da7463116", "value": "12288:0gB6ghvqN5h7jGcABBJnRuG5KGLX9+xi4UjFLum/lLrxFWbUArq+z6ysSqdAn6rM:vUNpaHUGlLt+mp5Rx0W+zQSqo6rnsz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517884, "uuid": "822b68b4-3918-4302-98ea-2cda0a2ea134", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517884, "uuid": "23320bd4-e707-42a0-a5ab-fd8565be28e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517884, "uuid": "bd4362fd-7e89-4dd9-8ad2-e0aea12e9e33", "value": "Payment Purpose.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005dbdaa-93d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528211, "uuid": "e5825bed-e267-4215-9ab2-e2da94f50186", "comment": "Malware payload (Mirai)", "value": "71fed38c0018d3454c1b6b8f4220d2d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528211, "uuid": "54966ab1-fd06-4798-b445-0bb915c15540", "comment": "Malware payload (Mirai)", "value": "6fd5c81dae8eae34a09c38d421a830ef3911747598643fece08d87470c397f36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528211, "uuid": "f73bdabc-8dd5-4021-bb29-114f1067d9c5", "comment": "Malware payload (Mirai)", "value": "a8a12b1a9da607526a95a75ddaca39caca782868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528211, "uuid": "6c95ca29-8e85-449c-a15c-4f67642aaee3", "comment": "Malware payload (Mirai)", "value": "7b571f9628eab2b5cb0bdbcc972cd8e1c6480486877db6176b7777920f10be137f479bd9b127c53163b46c2c8f800fe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528211, "uuid": "7fe30c1d-0dc2-4f6d-979f-7389ab554395", "value": "T192238DA7C43C7DD4D15982B8AD248A3C5B23D016A6933EF6764785638047EECF6093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528211, "uuid": "6baf07f3-b792-4348-91a1-9a0b50d5d304", "value": "768:6/eptstaT85n1O2alwtgR0Qmqq1rKFjDG4QZq557nHmbhCWoOF7O1CCPE:6/6s+Y1alwtgB6KOW57GNa+7O1CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528211, "uuid": "2b7552f6-e9e6-4973-a735-7e66ec690b61", "value": 47564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528211, "uuid": "23a18723-c933-4374-b00e-074319c0e998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528211, "uuid": "3badd6c9-e45e-402b-8388-3d7849b4cb90", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bf1436-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "a85e86cd-252f-43ca-8868-8ec51f02b3d1", "comment": "Malware payload (Heodo)", "value": "457ad7a19eb3479eb53c34af1e779833", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "53d81ff3-6df4-4007-be5a-d4e5c33fb492", "comment": "Malware payload (Heodo)", "value": "6ffd7e94305040e8731450b9722451f28461e13c59ea6aaf8e1b0296a1cd9927", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "c0fdd904-98f9-4bcb-be0e-14f304ef01f1", "comment": "Malware payload (Heodo)", "value": "e99f5878f45723af754d00cf2ab7ad7e8526e1ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "466272f6-0418-4301-ab1d-c3a9925387e7", "comment": "Malware payload (Heodo)", "value": "9f3badbad47880dea7fc92ff8385bf2390763d50de9e2780837954696b47225a3e77c577444f8ce9a77627f689832c62", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "64d5cf28-54e1-4815-b173-02de6d650ba3", "value": "T1C7A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "e94edf5f-b8ae-46d3-add9-f2ed8e34b15c", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "bab521c8-beb5-4d78-a110-6d6050bab4ca", "value": "12288:vicw4w2Vb0zq6k5Z2mTmjqkGXNrGHORQuBT:viSwub0W6LmTSwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549943, "uuid": "4cc1abed-3f8c-4a28-b745-c13cbdd1329d", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549943, "uuid": "75985125-cdc8-40d0-b5aa-832be45e9b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "210a27e4-3ac2-4827-a3e4-42b231bfd5d1", "value": "emotet_exe_e4_6ffd7e94305040e8731450b9722451f28461e13c59ea6aaf8e1b0296a1cd9927_2022-02-22__171217.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0138249-9373-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645488535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488535, "uuid": "62e72316-be73-4559-b197-39d794cfb81f", "comment": "Malware payload", "value": "c1f47a14a958e2345ba929afa829c7e7", "object_relation": "md5", "Tag": [ { "name": "Buhtrap", "colour": "#7A0EF4", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "UAC-0008", "colour": "#2900EB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488535, "uuid": "69766a7e-eb59-4b47-8443-50fa064251f4", "comment": "Malware payload", "value": "70038dc836f537dea842699af7d86efb201ec5198e46c536c981fd5eb8430e98", "object_relation": "sha256", "Tag": [ { "name": "Buhtrap", "colour": "#7A0EF4", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "UAC-0008", "colour": "#2900EB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488535, "uuid": "09c1d0a7-1531-40b3-bbac-a5d3e3b31b7b", "comment": "Malware payload", "value": "4e30b187cdd04d385854b5aa5b06999c76b84049", "object_relation": "sha1", "Tag": [ { "name": "Buhtrap", "colour": "#7A0EF4", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "UAC-0008", "colour": "#2900EB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488535, "uuid": "188d9cc4-0128-4651-aae6-0705daef0f9e", "comment": "Malware payload", "value": "c2c054225788d65bef833f78add755fb3fa751100b959170e89de3a130ac2c2c7b50704f12a65667aa3515ef4d1691ed", "object_relation": "sha3-384", "Tag": [ { "name": "Buhtrap", "colour": "#7A0EF4", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "UAC-0008", "colour": "#2900EB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488535, "uuid": "2b2b730f-c536-4346-b4b6-79feff22e668", "value": "T1207423578CDAF431FEB6A13953192448AADF9E9D0887F4333EB62BC9305A1798F10751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488535, "uuid": "086b160d-6ee9-4336-bd41-9e74a4f56c7a", "value": "6144:qS6QagdFCmzIDv5yZV7HywNWeB6vGGGol25gj//v/OsQVjuiOzqGVo2DKYm+YP:qIPCOIDv8fyLOgGGdF/n90yfGGG2DKJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488535, "uuid": "3d385268-e95f-40d9-bc6c-2c7e9fceae7b", "value": 358519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488535, "uuid": "dfbe84bf-6699-4735-b184-a093c1b041d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488535, "uuid": "53d924c6-a78e-4324-b26e-2d7f227d889d", "value": "70038dc836f537dea842699af7d86efb201ec5198e46c536c981fd5eb8430e98.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc1056c-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645539076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539076, "uuid": "1999b23b-0939-4694-9aa1-aaa4e2b6978d", "comment": "Malware payload (Formbook)", "value": "60ff2ec60ac40e8a8fb2b5266d440101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539076, "uuid": "45fc4f4c-d944-48ab-814e-33009ca3b178", "comment": "Malware payload (Formbook)", "value": "70363d434c9189f6c316737167fb509e5ac3f31c0c292cb3ecebd96022b22a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539076, "uuid": "932aa4f8-58cb-4ad7-b98f-d9c84f77ac73", "comment": "Malware payload (Formbook)", "value": "88da99e40516242121f2e4a21e85eb2f53cafa28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539076, "uuid": "2b5897fb-f129-4fc2-b1e4-2d1c4ba79b57", "comment": "Malware payload (Formbook)", "value": "d971596a8f8733104a00b178f6ea7d1d32f634e901598460d076e0401b232bb2ad7c9968402ba592b07af4aeff392ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539076, "uuid": "106fc9cf-59a5-4257-a754-05f82cc7fa84", "value": "T1FC84C1D37E418772F797EA7BD02D87E402661F399D90856262EF3252CB86213BCD2634", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539076, "uuid": "8a9d26e3-6247-435a-92d4-30820bcbdd49", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539076, "uuid": "cba7c533-8359-4144-b599-4ac2560711fb", "value": "6144:wxDC43zl+vGmBiacftEzReMhiTlCg8Rg2d9ycJ2g4tTvkAvaAuLcx1IDKJ3qYG0:MgBFYEw1pp85UltcAuQx64PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539076, "uuid": "1e611198-8108-4740-9763-09223d4ab3c0", "value": 402005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539076, "uuid": "1034d8f7-994f-41fd-a1fd-eb0a183d3509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539076, "uuid": "10a10d8c-3f74-4271-922a-611d7f0da029", "value": "IRQ2107799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e4a58a-93ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645513132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513132, "uuid": "1d65fc93-f9c3-4534-99fa-f80dfda9b89d", "comment": "Malware payload (Formbook)", "value": "bcfe829aab3c6c8bd717c9d635c29560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513132, "uuid": "08d3566d-7c3d-44da-b912-3ef04c2fccf3", "comment": "Malware payload (Formbook)", "value": "70c6fd4de902c8ccce31380698b123def84b4d209c8b824e1065349a5aee9de2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513132, "uuid": "3bac5881-18af-4574-982e-342c99ae3b33", "comment": "Malware payload (Formbook)", "value": "ac46a58805e36db010168f93bee865ffbb7df0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513132, "uuid": "fd99f771-ccbc-4d95-844b-3e0338d018bf", "comment": "Malware payload (Formbook)", "value": "c0465566a7f8b4a7a89e8ca1004e932da61e94beb3bf29eb6e16dded4e1564e1575e0844fe64cddaf257cb4b548a6415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513132, "uuid": "5deca3e1-1149-49eb-ad39-3f75587af84e", "value": "T1C805BF043AAB4F3DF1B94BB648D1EC64F7A9F6235C05F37E7C506686CA51B408D822B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513132, "uuid": "26348b17-07cf-41d2-9ed8-3ea9b90b97a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513132, "uuid": "eee2033a-b84b-4049-b70f-fd822ba9e421", "value": "24576:odkkOQDHBNN9NE2XWkQaFwf7ldyYDmQa/fAyoSr3:43EYWkQaGflkoyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513132, "uuid": "643696b8-a644-49d7-85b4-16f81930264d", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513132, "uuid": "68edbc6f-4f26-422b-93e7-bfd5935e6f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513132, "uuid": "c995258d-5db4-4831-b68e-993c88835032", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61242f3-93b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645516597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516597, "uuid": "9e9bb4d0-15cd-42ec-9743-8acdcac702f0", "comment": "Malware payload", "value": "0490c1f94d1a7f322257fed656036928", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516597, "uuid": "9499eeb7-8c57-4de3-90bf-06b31323b215", "comment": "Malware payload", "value": "714733bc51b08448da67b650e8b9fd2f048c2cf84063a0ea149084a5acd79453", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516597, "uuid": "702c41ae-be7a-4820-9490-5c0308f89f4b", "comment": "Malware payload", "value": "2ab7535954b54e442912014a869f161e26f84e05", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516597, "uuid": "7d5c4d62-4ef8-4d68-8a29-6abb0f726857", "comment": "Malware payload", "value": "697ad6ecf9ed852e3d1e99ae5d680b84cf85242e81a9a4ab859ea465a786e3b12499b7f64f9606f4b4ebc8a431dff04c", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516597, "uuid": "5eeba8c6-5d09-4e8c-a896-1ae9e8482337", "value": "T17F23C01CC5516642C663693CD43C88E129678D13611144CFD1FABECB1BA8F9B278FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516597, "uuid": "0acb73b6-1876-4317-a3b3-8e4930dcd03e", "value": "768:d+QRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTO:d+CJqHt7NJECQFfqAmYxfVzYJZRi1/Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516597, "uuid": "7a211953-f968-47cc-8d2e-f6e4f04f4777", "value": 47971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516597, "uuid": "74ac9715-fec3-494b-8f0f-56574443740d", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516597, "uuid": "ace2413e-8a47-4175-aa50-117d60e65dad", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c49d8b1-939c-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1645505977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505977, "uuid": "371d69d5-50db-408e-8e32-080e0a56f642", "comment": "Malware payload (CoinMiner)", "value": "4ebecfe32b68b7979873ddb9053cda4e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505977, "uuid": "ee326f11-52cf-4266-a3f1-672786c43902", "comment": "Malware payload (CoinMiner)", "value": "717dfc6fa41b8517420dfef7b8685f5ae3fe4754806229a6e794fec562e5deff", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505977, "uuid": "4ccb8548-fc0f-42f3-a0c3-e572b3a68d33", "comment": "Malware payload (CoinMiner)", "value": "aacc5c9475f77491b766a7c3a6bdf1511051f34b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505977, "uuid": "a5561776-cb96-4fb2-86d0-8f9dc6aa5b3a", "comment": "Malware payload (CoinMiner)", "value": "0cca89edee95060b9b0e5aa67af368d134ff9a797825f3d6f55c1ac7f7e6b9acd9048b663f049dc20c337c92cdaf509b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505977, "uuid": "afcdd401-11f6-4a91-83a1-11ea4e7e7852", "value": "T1D1473379F983B664C090C3FA031A62FB7E924DFA2BC34425E1D47B3E8A6177419D507A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505977, "uuid": "c29f7680-b967-4f0e-b31d-f082d0ff4b42", "value": "8121da246ea94cbab5bbea46d181bdcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505977, "uuid": "1991bb9c-11a1-472e-a662-80f5989c99a2", "value": "393216:2AYWhnCW3M6rcfNA7SmTqX6cvncQea1Xn6ZCwc+2ziVwtMX4oOZI59xrPMMRT:2AzCeM60NAm5vTwKzawtMITZM9BJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505977, "uuid": "6e191c8b-b70f-4094-ba6b-4c6e05f51175", "value": 24844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505977, "uuid": "230a8069-5ae7-476c-b035-b74a30985305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505977, "uuid": "71d99acb-6de6-4cda-aea7-7d4de665a120", "value": "view.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e7782b-9418-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645559404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559404, "uuid": "d5213c59-7843-49bc-b58d-04c099e92404", "comment": "Malware payload (Mirai)", "value": "150becf933a054058056248fc713f729", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559404, "uuid": "859e8bda-8390-4a02-8bc4-b8ac650e5f0d", "comment": "Malware payload (Mirai)", "value": "718c3825795154676cf7f51e3c80d59e093e77a8cee8433e8bc1120a93066555", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559404, "uuid": "8469168d-6c07-46db-b387-ff3d4e492fad", "comment": "Malware payload (Mirai)", "value": "b1c43c7f827ab562dbbc26d975b608b2022e0e55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559404, "uuid": "e99c0a34-7da5-4864-8c9b-f3578c9225c2", "comment": "Malware payload (Mirai)", "value": "90b6219ac04bd525de6b95b75506c41e88c31b33dba8d2ea643473e925ecab6a9d234cfc39bac076bae6615a99622967", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559404, "uuid": "3335c31c-182b-420b-a46f-dd54e21f54de", "value": "T19EE2E1B4D2DB2333CF3E2234E0156E1A65D93CDA8F53460A3D85C19179EA42CD2ADC9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559404, "uuid": "f2fd1a72-52aa-4bc1-b659-a789a14b395d", "value": "768:+bJMh2XcC23HiM1MOcSnI8oX4PoNCUAQsNpSbi:+bJVDu64I8cGoNFYUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559404, "uuid": "e583657a-cb08-4dd6-ad35-93e14df25549", "value": 32108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559404, "uuid": "f816d5e3-61b9-49d6-abc7-42b1c4f68d92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559404, "uuid": "f57d2fb8-4765-48eb-80d3-2b697a5f9ed1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ab061a-93f9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645546210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546210, "uuid": "f9e8b268-9632-4127-9b46-27bc191a891d", "comment": "Malware payload", "value": "ea5caba117360c92a3b637844720b8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546210, "uuid": "14cfdc71-0468-4376-b96f-7acee3b020bb", "comment": "Malware payload", "value": "71d487734becbc0583b0439adea1fd12a98793413d51194751cc730d6009616e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546210, "uuid": "ba878ed6-9b2f-4025-bc13-0c7acc4babff", "comment": "Malware payload", "value": "ff2999e084c31e428479cace932c78d09f4493af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546210, "uuid": "7094d94d-46ff-46bb-88d8-744de3aea846", "comment": "Malware payload", "value": "410458590599652c600efe2ecf77125e9102ce896847d6b7e1bb6670b2edfc363fe5ee7b37a0d55030905423ed8e2344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546210, "uuid": "50ed393c-0851-4a07-8a8d-2c1b71afc338", "value": "T161D412562020C6DFE2D202361865175FAAF4AF622336A58F57507EBCBF75B828F35312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546210, "uuid": "e39e3d07-2a2d-4521-9e24-d5c94688a921", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546210, "uuid": "b2d543b4-f056-4abb-a381-ce6f4f67cea1", "value": "12288:0b6UG1NAN8Axjam22QMPnJjUisxonUMq2PZgue0yzgX3GXHb8E:0bm1YfV2vh2nUgPZgpgXWX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546210, "uuid": "e9e05120-4ddb-4d1e-a9db-be443500c367", "value": 625056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546210, "uuid": "a1871dd5-c965-48fd-a389-5b96f0a83971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546210, "uuid": "91b51edd-70f3-42c4-b95a-94a705e9b5a4", "value": "Order 950112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bc0b29-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517274, "uuid": "e1dc7941-f9b4-4c7f-a0f3-7ef83e3fdacf", "comment": "Malware payload", "value": "73dfb4a9c26fa00545c47b2ca81a54eb", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517274, "uuid": "42bcc40e-0ab0-4261-b437-64d43531bb98", "comment": "Malware payload", "value": "727f124333294aaba156840955cbfc6ac7470768c65c1582c5e0dbfcb6f8722f", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517274, "uuid": "acd34f91-cb60-4215-bba5-bd03e7f5e4c7", "comment": "Malware payload", "value": "574dc9c608b637f57f4d11dab02c68b1c7a1506a", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517274, "uuid": "2548443a-219e-4cc3-8cbc-3f6c83c564aa", "comment": "Malware payload", "value": "f5d2caa5d8de42154cade9ac0b2545a13e872e41ddd28ac32c69fe8bff6a93a59947ec87b9a0ab03458e00678cf52b3e", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517274, "uuid": "380d57bc-65c2-4e2a-8658-d94aec85c86c", "value": "T18FD46D55BECA6EA1EFBF47B78361D62D0126736E03A0A6CF6643019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517274, "uuid": "e175416a-f7b0-4a94-9f36-89a4935fe3a1", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517274, "uuid": "f46c7102-1f7c-4d09-8db9-8a3da80e70b4", "value": "12288:+0Ws7IMsR4yVld8bzbBSreBBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqjR:+0bskX1xBY4ZyrE7K3yl8PeVooA/AB2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517274, "uuid": "c557e0c1-c3c9-4e01-ba87-e04913ba604d", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517274, "uuid": "f2bdafdc-22c8-477d-b7ae-de4da1baf93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517274, "uuid": "59d7efa0-d06a-4b7a-b3b9-2bfd268fc515", "value": "Factura 0000000065.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7d9505-9407-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552200, "uuid": "e1d79271-0f2a-426d-a472-26346dab9a1b", "comment": "Malware payload (Heodo)", "value": "b67a5d75faf12fb98e30337ace0047e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552200, "uuid": "5f45a2a9-f43e-400c-a3c1-1da28930ade3", "comment": "Malware payload (Heodo)", "value": "72d3ceb0fae8cba0b68541b15373c30ae673f7af50410e8cdd62e55d9c3db51d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552200, "uuid": "f76b805f-4992-40c6-8315-f22bf3581b91", "comment": "Malware payload (Heodo)", "value": "4c3e390cd3866bf2e8e1ba3643039bc706d10d24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552200, "uuid": "6af3a6fe-c1b6-4cd9-9ebf-6981940bddf0", "comment": "Malware payload (Heodo)", "value": "4eadcf9bc199267c7354da300b37994fba5f18412531111e5003a60a9aeb0fa2653633ca0732f63ac502e889bcdc8d34", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552200, "uuid": "087c5287-394f-4a18-a3ee-cb3fa504f9e2", "value": "T1C1A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552200, "uuid": "88ce4d9d-8eba-496a-9f55-3298d7118ec2", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552200, "uuid": "2d9faf89-9290-4543-863a-48fd00aaaea3", "value": "12288:vicw4w2Vb0zq6k5Z2mTXjqkGXNrGHORQuBT:viSwub0W6LmTBwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552200, "uuid": "b395d6cb-2c7e-4314-8352-2ae65116ca40", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552200, "uuid": "8eb4eeed-17cb-40c7-9bc9-c718a622991d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552200, "uuid": "f373b946-1536-41bb-a5a3-14ee0d54024e", "value": "CCaedhyGDjWYpELoVA2I4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdc1de3-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645514519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514519, "uuid": "e1cc5846-b2a3-4b83-beb2-a855de42e6e9", "comment": "Malware payload (GuLoader)", "value": "1b318a60a3f5a206324d1877c6b65294", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514519, "uuid": "45dc033b-217a-40ca-85d6-6a3e0d94a164", "comment": "Malware payload (GuLoader)", "value": "731a5f2b082ece3db916ed43df03f9911557a8906330ff390102833ac1b3c2ba", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514519, "uuid": "3d64499e-b316-481f-a1e8-53a52ee4524d", "comment": "Malware payload (GuLoader)", "value": "20a48226e2674c9ac6fe219e8f98655b938fc187", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514519, "uuid": "00ed6de8-1aba-4207-985b-532e89accfa7", "comment": "Malware payload (GuLoader)", "value": "5ea075fcd5d0e146e8c2e1a9d608d2060062557bbe68a642d8bd87871016979c7db127d39a4fa687b27db73488b7f3e3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514519, "uuid": "802b7f98-8b58-4b24-8a24-91f88de04c1b", "value": "T1FA1402D9FE50A05DED0EE6750052D5B383B4FC849D68739225A8B10F3AB0A77682496F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514519, "uuid": "25979f01-8be5-4dd2-8800-1d019b75b711", "value": "3072:69aXVSdo/y/PWExqW70md+RPCccxQwN5zbeOiN4GXawvHxcUKbO:+aXMdx5x0mdkOxD5zbeOi64awvHxGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514519, "uuid": "dc6b746e-ef33-4457-8732-bf2c0c55d7e7", "value": 191192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514519, "uuid": "18b514c7-9a8a-4378-9493-3fd51b5cd888", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514519, "uuid": "cf01a19c-d63c-4f01-b4e9-6fe74a47a277", "value": "Purchase Order #160222CT71.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e5c0f2-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645556062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556062, "uuid": "83a0f864-5cd2-4510-9756-cf1b83c853a9", "comment": "Malware payload", "value": "e397e14490f1d0d71aa7d6c9f2b5331b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556062, "uuid": "0d4aca46-66a6-4c1b-82bd-8fec805fbbe7", "comment": "Malware payload", "value": "741c8054bd13001312788bffa5b1d5dda8082b2677d9a777c0b9e71ae670df95", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556062, "uuid": "689b55ff-61e4-4fe7-ade7-4ba6c2538fd3", "comment": "Malware payload", "value": "50ba6e903b3106f51b133a218e059d4c76000313", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645556062, "uuid": "0341ddac-b877-4906-9d43-4f66261397f1", "comment": "Malware payload", "value": "c23f5b87849a675eb279a1f63a1a6f311474c3f1af040998e5b4ee4c6dfbd32f3a04169d24d195810df9b15a5d57ff62", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556062, "uuid": "a94b4c37-44fb-41aa-97c3-050d2b3b04a1", "value": "T11C93F669B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556062, "uuid": "50696944-c929-42a0-ba4e-25f27b7181b6", "value": "1536:Byehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQxtkWvgrPE4nWHPNc2AF:Byehv7q2Pjx45uoDGTj+5xtekEvi8/di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645556062, "uuid": "ef99f642-caf0-42ca-bb8e-32f32798c833", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645556062, "uuid": "0e9ff957-e6e6-4f74-a1fc-b219ab1bf48b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645556062, "uuid": "398a0b2c-9d00-47e1-9a9a-65c16656fbc9", "value": "tmp_byuwoid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d413b474-939b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645505802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505802, "uuid": "de80d09b-7437-443d-8a5a-ce1c69e44a74", "comment": "Malware payload (Mirai)", "value": "1cdc235cd8e676a5b98cccabdb70072f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505802, "uuid": "1160ab2b-f88c-44a2-8858-9f7189f762d7", "comment": "Malware payload (Mirai)", "value": "742831c0480b7748c9741983db289c13e45d44517d647df0e3f6796f75540dfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505802, "uuid": "bea0447c-c5a2-4e18-bd7c-bc57b7da05b8", "comment": "Malware payload (Mirai)", "value": "b15a3591c52e7db5d98e5b50d8a0a7282eac14bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505802, "uuid": "124a39be-7f7d-406e-a749-4c50833e8d39", "comment": "Malware payload (Mirai)", "value": "c9363933129e37ac7b9e0c1880fdc3aa7e13097dd3fa9bac56d0fe7d75ef76a93e9803d77a2269ff8e26312c37244b93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505802, "uuid": "84476774-9bd1-4a08-8e78-240b2c56b069", "value": "T1A22302706B81CF7388715A32AC0B484B77558AF74F28B44205839D58BAFAF1977BA317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505802, "uuid": "01429b86-b264-40c7-83a5-219db2cf6f90", "value": "768:kj3BIeiLz3Yw935j55Dw1nn+/uOt+Gq3UItEXh57CjGmmmFnub:kieiLDHj5581n+mBptE5mFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505802, "uuid": "dea142e2-00e8-49a6-99f9-4be914b86117", "value": 49796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505802, "uuid": "1e93f6fc-79fa-450a-972c-d15a2e17a736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505802, "uuid": "a0a689c9-ef1a-4a99-8daa-8289a14b0e4f", "value": "SecuriteInfo.com.Linux.Mirai.1429.5124.11699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07738aaa-93b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645516197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516197, "uuid": "8e191535-8519-4a9f-9377-5746d4b6657d", "comment": "Malware payload", "value": "f4be8a343807cff00625a4d08379ee9d", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516197, "uuid": "4ac89434-88e8-468e-857a-bb4666da953c", "comment": "Malware payload", "value": "749e1f2113099fbc1e5ef00d754c11a2901b41bbd918b6f06eeea29ee8f644e5", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516197, "uuid": "c397d78d-ea41-4261-b22a-bf18f8532986", "comment": "Malware payload", "value": "966a08bccc48f7b4fa3d263aff9885640888b81b", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516197, "uuid": "8a9bbaca-f13a-4f1b-8ebf-a94a53dfadaf", "comment": "Malware payload", "value": "186dd9b8458c8db5c4508871da4f9b8804358828199fe3d9a6c038cc37ef3bd21acc591961b9240c96a5e61df87b621d", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516197, "uuid": "e4dd3e34-2055-4e92-a8d3-6b54dce65279", "value": "T16323C01CC5515616C1B3653DC43984E11D569C13B21588CFE1E9BE8F0BA8F9A1B4FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516197, "uuid": "0a8ae136-7b7d-4676-a186-eaab5ca12516", "value": "768:A+WRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTL:A+sJqHt7NJECQFfqAjcIt9iRhlZk1Cb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516197, "uuid": "99c142ed-e668-47da-9262-4a66613607ec", "value": 47984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516197, "uuid": "b64edd25-b972-4bd7-a90c-7b28c960ac02", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516197, "uuid": "9f915da3-7762-4ecb-b615-5244cf868c90", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e9c60c-9373-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645488362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488362, "uuid": "4a7f0cd0-fe4a-4732-9f28-6ac4783353da", "comment": "Malware payload", "value": "43a9a42b9a656d1ca39a3337a841ad5d", "object_relation": "md5", "Tag": [ { "name": "Buhtrap", "colour": "#7A0EF4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NTDSDumpEx", "colour": "#F7C366", "exportable": true, "hide_tag": false }, { "name": "UAC-0008", "colour": "#2900EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488362, "uuid": "786203e9-007b-4cfa-b309-077d3b0c5a4c", "comment": "Malware payload", "value": "74bd4b1375c7554e1a168c71de148f325319773f0869e350df538cee0543e216", "object_relation": "sha256", "Tag": [ { "name": "Buhtrap", "colour": "#7A0EF4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NTDSDumpEx", "colour": "#F7C366", "exportable": true, "hide_tag": false }, { "name": "UAC-0008", "colour": "#2900EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488362, "uuid": "e135c88d-9dba-4743-952e-b26d9f57f0d0", "comment": "Malware payload", "value": "710e0a7cb0eccf48ecd40dfb198d61c7c2db58f1", "object_relation": "sha1", "Tag": [ { "name": "Buhtrap", "colour": "#7A0EF4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NTDSDumpEx", "colour": "#F7C366", "exportable": true, "hide_tag": false }, { "name": "UAC-0008", "colour": "#2900EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488362, "uuid": "186a886f-6184-409f-80f9-aa7bf42ea0f6", "comment": "Malware payload", "value": "364eea6a9764638b51e30b03b1ca82d3c665c274dfdea1f03eb06874012b985c8e8b0bfa37178b57d01133253262398d", "object_relation": "sha3-384", "Tag": [ { "name": "Buhtrap", "colour": "#7A0EF4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NTDSDumpEx", "colour": "#F7C366", "exportable": true, "hide_tag": false }, { "name": "UAC-0008", "colour": "#2900EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488362, "uuid": "da0a66e1-7dde-4607-a626-c84b15609d4e", "value": "T133147C21B480C031D4B318314AF9D6B9A93CFD610B646ADFA3D81A7E4F745E17A31B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488362, "uuid": "ddf4fa8f-c85a-4862-85ec-6538f620beb4", "value": "952610b1af9affd9cfbaa0205bc90ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488362, "uuid": "fe22d37d-50c5-470c-b5dc-da338b1d82d8", "value": "3072:bdu0tW5vAv0GsmtFf6XFmMfGki/yJaCPR8Ckh5gOt0AwQ3Zdpmy:/A5v60FUki/yb8gvAwQ3ZdMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488362, "uuid": "b496915a-b001-4299-aaef-a22303d8e406", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488362, "uuid": "3ccb7837-ec5a-4c68-b892-d3da8c9e0aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488362, "uuid": "a3b064d1-2234-4f7f-923a-f1a6daa37b06", "value": "74bd4b1375c7554e1a168c71de148f325319773f0869e350df538cee0543e216.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bb9b32-940b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645553620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553620, "uuid": "ee65dcc4-d3c3-4648-bf36-628bfffa31f7", "comment": "Malware payload", "value": "f41e030b6f8d92e0646bb8b42c7572e6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553620, "uuid": "66309310-7ef1-4ae3-8f68-fe7fcde526ad", "comment": "Malware payload", "value": "74e3a75a1cb4a6067407112615bcfb91f7fad83a28d11bb5e9064d1bafe6e380", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553620, "uuid": "8d72a154-34cf-4908-b44a-ef988f557324", "comment": "Malware payload", "value": "f8249ffcbd6d06656a9d0b7ab2dacd8b0c1faca3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553620, "uuid": "0b979c5a-a945-4575-a3a2-8fdc65ca5b70", "comment": "Malware payload", "value": "3b8cb09e778d19ea4d726e71baf56eafcf129d4ff5b25cc632621fd261e00ae7249d5bb6e6492662f161675dc7adaa5a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553620, "uuid": "44715d4c-ca0c-4ae4-b073-437e11f543e0", "value": "T18E930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553620, "uuid": "6f65384f-7601-47da-90ed-813657d21b50", "value": "1536:cyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAvkWvgrPE4nWHPNc2A6:cyehv7q2Pjx45uoDGTj+5xtekEvi8/d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553620, "uuid": "458c95b1-f423-41c1-b818-6a65ac2c3313", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553620, "uuid": "97e56bc9-df8f-4913-a316-01b4b0e3b7e2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553620, "uuid": "c8a6b8af-20ad-47c8-8ccb-ec96575a5c6a", "value": "tmp5yxue3yd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1beca90b-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645514513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514513, "uuid": "381e4828-cfb5-4b1b-b304-dbbd25d1c161", "comment": "Malware payload", "value": "6e86696579372b72de819058e4ad0290", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514513, "uuid": "59bb6dce-d69c-4a51-91c2-2559169eb533", "comment": "Malware payload", "value": "758ffe560667c9d4fe8189589ee062a0f4a50c9955526d95826e686420810d11", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514513, "uuid": "c5bde21a-cb88-4787-839c-769ab38791ab", "comment": "Malware payload", "value": "21224a9d92277de131de71eb7c4dbce6541ced63", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514513, "uuid": "021ddbe5-f3af-4bcb-a265-cb1518667062", "comment": "Malware payload", "value": "57df7089b8cab5f1b66a4f4f281ab1fd6944536130fc4285dc3cfa88768ae09c71f766478d569fcd49a865f9f442a3de", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514513, "uuid": "79541dcd-ffad-4a0a-a716-b403700f30f3", "value": "T13723BE211A096E7DEC89F1B27C1349378EBEFE115B2CE2009C43761E907D6CE8E99A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514513, "uuid": "7685f411-e120-4f99-ac47-502131071e4c", "value": "1536:pFqqqqqqqqqqqqqqqqqqqqqqqqqqqSqqqqqqqqqqqqqqqqqqqqqqqqqqqsqqqqqj:pFqqqqqqqqqqqqqqqqqqqqqqqqqqqSqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514513, "uuid": "422d4e6d-5187-4847-9d96-82d2d582b803", "value": 49576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514513, "uuid": "a1e55248-4b5a-4954-b97f-5b733d5167d8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514513, "uuid": "d293fd71-0321-4b3d-ac4c-65e93b1ae367", "value": "ORIGINAL BL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74d83ab-940b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645553938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553938, "uuid": "95d2af5c-3f4f-495c-b0a1-65e6a4ce563c", "comment": "Malware payload", "value": "c582b65d538a691a9535b5d98bcaa5fc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553938, "uuid": "be3217d3-9f80-4692-a038-4ba6a3cc7dc0", "comment": "Malware payload", "value": "75a24f08c376195d3b99702955b6d0f1798c358461d98e969a9a1642494f44e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553938, "uuid": "1e9ab838-7b06-49dd-96b1-873a59753fb5", "comment": "Malware payload", "value": "6d2e087256b02e0e925fb38f93566fb61dfdf26d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553938, "uuid": "e6d313cd-22cf-4172-bb03-0993555c10d5", "comment": "Malware payload", "value": "e7911631c390b471e3a5d0c053fd8093291001c5219635a7f2fd9dd018cf83306a3a198ad9be968ea276cd7cfd5d54a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553938, "uuid": "dd411deb-4ee5-4ca9-a5a7-f62f5a2864ec", "value": "T1E293F669B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553938, "uuid": "b2da2673-5b3d-4565-8eaa-5571d112b275", "value": "1536:6yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQsvkWvgrPE4nWHPNc2Ap:6yehv7q2Pjx45uoDGTj+5xtekEvi8/d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553938, "uuid": "df174038-0164-424f-adff-c979338eb986", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553938, "uuid": "e93cc79c-ed8c-4e34-a06f-a7b45768b041", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553938, "uuid": "dd4fb2d3-d6bf-4cb4-b876-3e2ead29d65e", "value": "tmpfxd0k9qj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84398989-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "c18db855-2dfc-4d0d-ae0a-5a6304234648", "comment": "Malware payload (Heodo)", "value": "0a4c14b3f44d99e9b2ef18e093a773f3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "12d07dd3-079f-4e55-ba10-2240c631de82", "comment": "Malware payload (Heodo)", "value": "7694d19ed22f65c4392f4f2c46a0d0ca5fc73582ca30c6af16517e29353fe3b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "56d69619-3fd1-4e10-8e27-3a89915ce617", "comment": "Malware payload (Heodo)", "value": "a4c98cbcfe174dcbc1f2606298585af4bfd14da5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "d1099da9-f1bf-4528-ac22-e2af8a22bf60", "comment": "Malware payload (Heodo)", "value": "5f5bb84528129d54597529c8e137ba851ec39b091415659aea6bb4d68f4fc2171b4d1e56c1f70ade1bc1c16413040084", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "9dc5e2f1-663d-4a2a-99e7-dd069f3e10ee", "value": "T1E1B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "9efddbe3-ccc4-4167-9ee0-3cd5f05c7cbe", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "75fd2432-f2ad-4b6f-b07e-846cdf73f4ce", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wJIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzW2zo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564939, "uuid": "202aa54d-1b27-4e46-87c8-afa7d7bd1fcd", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564939, "uuid": "4ed52c75-7a00-4360-ba76-460f257ec754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "896fd7e3-086a-44c9-8203-48f944f29295", "value": "emotet_exe_e5_7694d19ed22f65c4392f4f2c46a0d0ca5fc73582ca30c6af16517e29353fe3b8_2022-02-22__212214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b22360-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555789, "uuid": "ed93ca1a-779b-4896-bc7b-297ff64ab321", "comment": "Malware payload", "value": "716a3da37ed1d5d3b16e71c83cb15841", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555789, "uuid": "47698cc3-0ce3-4e42-aacd-71ca15388b67", "comment": "Malware payload", "value": "76f2dd40f6ae5beb1edb6c19a40117eba53e869d16b78f1c9f005b20940bf61a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555789, "uuid": "df3a0adf-8943-4285-b257-b6057add93ef", "comment": "Malware payload", "value": "5be42cdfd45dae66715abe3c10f9e60fb02a0e82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555789, "uuid": "5b1a7c14-f898-4940-8368-f6d609d06c27", "comment": "Malware payload", "value": "ecf9852776adbff0493161f196f88d2aa38c1a260916d874600ce5f5d3381062ecc81b8f7cc5bc821d831dba6f4c0f41", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555789, "uuid": "70c2f363-734c-48cc-b993-5533445ed224", "value": "T13213E113F5C1BDE2D5525E3CAE1B61F8F64B8A83E208560F1504E29C2F118A717FB69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555789, "uuid": "a9308d18-bc5a-4f2a-9ff2-0e82d0905f09", "value": "768:NLz84bdTL5oKrovXzBy78MG67yenBlMG3q8JpVzUH95vfLz:NLz84bdTL59ovtywMh3hpVaTvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555789, "uuid": "686b847c-e188-4b15-8186-f7cda1225751", "value": 43746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555789, "uuid": "4a88d305-f657-4ed1-9841-544b5b8ae0ce", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555789, "uuid": "9e1d4dd5-f621-4184-9e57-e1fc43751b4b", "value": "tmpgu2jn6fn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a7ad59-93d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528214, "uuid": "cc58a452-f04a-4163-bf93-51cc3b236fa9", "comment": "Malware payload (Mirai)", "value": "dc05daa637d292c7062136d9865dad06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528214, "uuid": "a0d79844-cd3c-4a20-9100-eabb5489a507", "comment": "Malware payload (Mirai)", "value": "775138cef2baf374a71c66593e55c1ce5c5e148d2a49a5ce5f988f63e160ffd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528214, "uuid": "19ec0a16-c8d7-4f07-9bf8-98b3c88a8686", "comment": "Malware payload (Mirai)", "value": "33deea8cae01f25cc91fd53d4b08e89dd41b391f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528214, "uuid": "23f1cda2-a829-4856-bafa-635fea5f77ad", "comment": "Malware payload (Mirai)", "value": "19baf24b4f8023c069c255efea33b669d725fb4e0580a2b84e7a8efb22ed42dab235c227611323e23d3bb120e6a7247d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528214, "uuid": "9af17617-6d04-4cd0-a1d6-d9e6efba3f2b", "value": "T1EB335A22A9791E27C0D4F47A62F78729B2F50B0E25A88B1E7D620F4EFF214C0556B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528214, "uuid": "25b57b2d-5e58-4efd-acda-78e2e2227536", "value": "768:g87vjw1o6q9m+xy5agNdXEGgp0lBdPWkXGeO+hZrEFuk:lvjw1XSm+xytNdUGgp+Bdssh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528214, "uuid": "96836e7c-16b9-4f04-bc22-d28c0e6ee19f", "value": 54740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528214, "uuid": "40e9f156-008d-4d30-a324-9ed905add549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528214, "uuid": "16e3b87e-74a1-49f4-bc62-b811104d8465", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753127bb-93b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645516810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516810, "uuid": "55d5c467-70ae-49ff-bc40-1112ffa4fcf2", "comment": "Malware payload", "value": "cfd4f03b2097e03f1c19efa04efef8eb", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516810, "uuid": "c47a6f62-ef7d-4ecf-a97d-f8bbf71ce2d0", "comment": "Malware payload", "value": "78887de2b46e92439ef506bb079d7160a8dbe197f4f670908543500373fc21ad", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516810, "uuid": "7a0b6026-2b14-45c5-97d1-186229f88f37", "comment": "Malware payload", "value": "8b6572184ced5662eb7ce5b13ad388a91aa466d1", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516810, "uuid": "2a5af8eb-76d1-4531-986b-0abe591f5d52", "comment": "Malware payload", "value": "ca260e230cd4e575ed729bb32d1df02d0c62f8e7badb68fd613869ee170e6dbd8d837e6dbe05b887a30daf844e2ec8d6", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516810, "uuid": "c3896baa-0259-48dd-abc9-9902d400d2cc", "value": "T1F423D11CC9402656C2B3693ED07884D416668C07B61544CFE1EEBE8B0B95F9B2B8FFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516810, "uuid": "71fbbbeb-37f4-464b-881e-2d980e1666ad", "value": "768:O+2RD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnT+:O+MJqHt7NJECQFfqANnL25iu2yfEt1/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516810, "uuid": "bfc5726c-760b-4654-9e0a-bcd23c9606ae", "value": 47991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516810, "uuid": "db7c5417-e704-4a28-9e07-b6a52945c213", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516810, "uuid": "481fb74f-88b4-4a3a-8f67-419a8676e4d9", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11237576-93ea-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645539406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539406, "uuid": "63afa473-0b09-4c94-8f92-2ffdf506e097", "comment": "Malware payload", "value": "ecec96b02b6145cd439cb35413800286", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539406, "uuid": "d97a81d3-079e-4311-8418-012d69042906", "comment": "Malware payload", "value": "78d0d1b6cc6250382a0dcdd2ca86e83e87e8ffe8fcec776a49054df29fefaa01", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539406, "uuid": "d573f923-2114-4c14-b402-82cd64af3b7c", "comment": "Malware payload", "value": "1992ae6913ec97063184f5f869aecc7fe984d670", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539406, "uuid": "0aa81492-1681-44dd-8f30-de1673942a0d", "comment": "Malware payload", "value": "28ffe3f54580b491f07349d8576cf1e6b4941a305d911d88eda7efddeae876efae551b668be97bbadc41f7578d14a63c", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539406, "uuid": "29fb4cfd-4e96-4881-8bcb-806c123cd4ec", "value": "T1EC523B3D9668D9A4CF4DB2E6722AFE0902DDBD5487D6E0E37BBC7370970A25E1A07500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539406, "uuid": "cf69ee9c-23c5-40c0-be48-eb437b35da4d", "value": "384:wg4bWaP9t+FcWjLxSAc1EyDu6h/cO/lxN:wgM1+QAByDu6h/1/lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539406, "uuid": "02a12bc0-14d5-4693-af3a-7bd8882fcc74", "value": 13435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539406, "uuid": "6d94c213-ca66-4408-bd0c-e68b1c5e8c18", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539406, "uuid": "6373a9b6-4d7f-4f2b-a700-6d31b7a2697f", "value": "TELEX TRANSFER MT103.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4dfdbf-9408-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552366, "uuid": "0ac4dba6-33b5-4d12-af7e-bcda694707ec", "comment": "Malware payload (Heodo)", "value": "c508b67e530df18f81d64ca131a56771", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552366, "uuid": "929d3515-8b93-4d5b-b09f-0e288bfa3855", "comment": "Malware payload (Heodo)", "value": "78ffa83fc439b14ea158eaec2a6b23688a3701f5a11ddc731a9754502c47e13d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552366, "uuid": "f918a7de-66b8-4c79-9b2e-6f2f600cb368", "comment": "Malware payload (Heodo)", "value": "0c3e8d81d3813c57b02216d06ff3f2f30f8581ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552366, "uuid": "2c49418f-6f9d-4cb1-a2cb-1b26801ae833", "comment": "Malware payload (Heodo)", "value": "0b37ba7472464d892cf228c47db2a43e5f06fcb64d808b0dcf2a6442a5f791cfd7bafb34e053901f6c36d119f88d49d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552366, "uuid": "8971fbcd-77ce-4e73-91d5-2af78b0008e9", "value": "T1EEA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552366, "uuid": "91006d41-9ee8-4e4c-af58-35be54ec9d2c", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552366, "uuid": "74c37ce6-c57e-4033-b0ed-56c2a7d5ce78", "value": "12288:vicw4w2Vb0zq6k5Z2mT0jqkGXNrGHORQuBT:viSwub0W6LmTEwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552366, "uuid": "9770bfc1-e014-4f86-9e4b-1b8e7935ca87", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552366, "uuid": "20242792-cc70-44da-bd7e-e0a0676f46a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552366, "uuid": "d893d873-8a83-494d-adf4-4864bad680af", "value": "c508b67e530df18f81d64ca131a56771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474f15a7-93a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645509002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509002, "uuid": "dce7d9df-aab0-47e8-bb9a-f50df68b4655", "comment": "Malware payload (Mirai)", "value": "1436969a42172853a75b7c5bfb904a01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509002, "uuid": "3085de93-1e3a-49a1-833f-7cf8d53c7d27", "comment": "Malware payload (Mirai)", "value": "79ed873eca36bdadee142b9a4734bdd1d7ede34de02884af43095c1d027c1520", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509002, "uuid": "7dbba838-c4c8-4689-9aa3-54e45028e8dc", "comment": "Malware payload (Mirai)", "value": "d41056ea8de5bc54e3d10858c18944a087698a5e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509002, "uuid": "2c7072e4-a5d6-47f3-8b26-65d658001efb", "comment": "Malware payload (Mirai)", "value": "f648e58fa9e578aacc16faadef49d9fef9f5a5b8f1513cda92cf373dd55659a71fd2f7d028341e9d7a166e1342babed5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509002, "uuid": "4e2e0f60-523c-4a86-98b2-b9b1faebce8a", "value": "T1C1630232E4CA2E7855B10C37F4684087BA2C8BBBE67DB55305D0FB59C5B10D63BB9A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509002, "uuid": "13e569d1-f995-4a7b-95b8-d42cb45e19b3", "value": "1536:fsogQiJvOIyCCW5rMxHmvbjTNQ7SDGLBWr3QzEQ+D:fsogQmHyjW9k+bNirLBWr3Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645509002, "uuid": "d4a6636d-f2d8-473f-8bb2-54ad91945ca8", "value": 67960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645509002, "uuid": "7a14c227-376f-46f5-bcbf-e574d126e2bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509002, "uuid": "f9ee93dc-55b8-46bb-858f-51b6f31d5854", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab5aad0-940c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554266, "uuid": "c18fe8dd-941b-4a55-9dad-0b689e8b218b", "comment": "Malware payload (Heodo)", "value": "9aade21740fc98bd57951ac14a302c87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554266, "uuid": "b4de47a8-08b9-4e69-bc0a-545674d78a91", "comment": "Malware payload (Heodo)", "value": "7a74c88610b336a5041665d2e92ca3fa47bdff335a168c58aaa5a5089fa6df10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554266, "uuid": "999c7f52-d9f4-4ad7-a674-cde6b5a02680", "comment": "Malware payload (Heodo)", "value": "db4c58c0e61d9bdc12848580eb43163d20c10497", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554266, "uuid": "86f5b33b-448e-44c0-b987-b8c9f74c7897", "comment": "Malware payload (Heodo)", "value": "a2668459779716c048124c247519adec564471583aea9ee5a0cb7f16121a5284982cf0f8f10167d97705e3d60625d608", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554266, "uuid": "541db96b-03d3-461b-9f13-6b242b29652e", "value": "T1E0A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554266, "uuid": "c025e823-6186-4270-adc8-58ddce0279a0", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554266, "uuid": "fd3e3d7e-7b24-4d4b-9597-a134ecb4bb09", "value": "12288:vicw4w2Vb0zq6k5Z2mTrjqkGXNrGHORQuBT:viSwub0W6LmTNwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554266, "uuid": "2fed7e2d-4864-4646-af2c-fef3d435b35b", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554266, "uuid": "7d83c835-27bd-4e9d-8426-2ecba021ad04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554266, "uuid": "e17031a7-b8a8-4bec-84f5-2929e44b250d", "value": "9aade21740fc98bd57951ac14a302c87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279b9d0d-93af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645514103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514103, "uuid": "b27ea866-3d55-449b-9ab9-0fcb9388dc7c", "comment": "Malware payload", "value": "ca8680e03c293b5309928fc2702c5681", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514103, "uuid": "7e278804-da9e-4be2-8b61-d2c33cf35888", "comment": "Malware payload", "value": "7ac43c074514c0fffac64bb04f0e86f31652acd089712ef16931cd2cc8cf8eaa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514103, "uuid": "24f8b954-1f7c-4526-9af6-2ff11014a991", "comment": "Malware payload", "value": "87908e11bba5ad0ae34d8358beebc0ceacb81d45", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514103, "uuid": "def7e40d-ed3d-46c4-98e9-fb96c531d73a", "comment": "Malware payload", "value": "222aaa92718d8bb9d71faf1e86b7c1f3274b48ce6e8a0c58dea69b9ba489834d76e905a85041fc5fa2d9b544d7cde2d8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514103, "uuid": "59f592cd-44dc-4e6f-8302-156916ac2996", "value": "T1EF95A832B1317A87C3161461665FBE86530CBD47B2C65F8C905DFBF82CE6CA69302E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514103, "uuid": "eb3728dc-efe8-4541-a9ae-d13c2e1d06b9", "value": "1536:ib8BvBQeAe3ePe3efe3e8e3eYe3eye3e9e3efe3eAe3e2e3eQe3eEe3eUe3eye3y:bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514103, "uuid": "636706a1-cb98-4c0a-a47d-e0ccfe50aacf", "value": 2051528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514103, "uuid": "e291b9b5-0ca7-4985-a370-9c3f6c0d9727", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514103, "uuid": "a0991e09-cd49-48ae-bfce-1ce7e1bcedb8", "value": "RFQDJT5118F-220322.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330c9140-93c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645522283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522283, "uuid": "2d3eb424-b214-4e4a-b27e-3a355d510556", "comment": "Malware payload", "value": "50a31cd8274e491ffbc3c9cf9c23cdfe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522283, "uuid": "253860c9-d855-48a1-8073-525be85619c2", "comment": "Malware payload", "value": "7b3fb34b0625198f0efb3598355a903806273a63738c0d4a8aa08773e7f224b4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522283, "uuid": "fdace0fb-388b-483d-a562-46478b930175", "comment": "Malware payload", "value": "060593cf71fb1fd3b8153b343ff33ee67040ebb8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522283, "uuid": "fe040fed-5810-4a59-af1c-d9c9b28fb572", "comment": "Malware payload", "value": "35951c78b68217eb19f80ee41b4be44c1a7f4d3c29cd44c67335311069e55dd633932a1117389394747ba4f0ad439109", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522283, "uuid": "003fc928-2b2b-460c-a2bc-452c217e6f92", "value": "T19D45059203890BBDF68D0EC5D94B215720F2D5667E251688AFB36EE7BC3BD849430736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522283, "uuid": "7323da19-c1cb-4c43-9071-9fcfaab23c88", "value": "1536:OFWKHEABcYQ4oTxO11/b1XPpxEv1NyuCoFb8vkgKxJ6z1x6hyh7oN4zyjtn9yfDb:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645522283, "uuid": "34cca018-c7cd-4a27-9b99-433504fa6263", "value": 1178823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645522283, "uuid": "b02c6324-5b59-4af0-8941-b9c75faaf78c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522283, "uuid": "7e53e5da-c5ec-45f5-8e9a-a724df213ff3", "value": "GJutYJXE.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fea9903-9373-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488320, "uuid": "cc0522da-0a46-46cc-8121-9b9ff023f875", "comment": "Malware payload (Mirai)", "value": "f88109c730e14dde4db747e338f9857e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488320, "uuid": "bb085491-6b23-4035-a63b-f2eba7533c70", "comment": "Malware payload (Mirai)", "value": "7b6fe32d5050c30de7acf3f79116deb6554dc2282e770dafba795ee0fca922a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488320, "uuid": "d23f56ef-d294-4b0e-a129-802d9eb58fab", "comment": "Malware payload (Mirai)", "value": "84f21d1dd1ca6c6c63a4784f4bb0abe42cc7b8f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488320, "uuid": "ba564256-13de-4ef3-acdb-bce991ac472a", "comment": "Malware payload (Mirai)", "value": "4fce0c1485a034d99d3c6b011e0ce98589830431abb53c1111c554c7621b2c19f99f35b08fccb5e2f353a184acf6c21c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488320, "uuid": "0bb0931f-01dc-4757-a4ca-af61dfe1974b", "value": "T1F4D2F1FDBC34CF9BF2CE10B94CB8DA2B71D6EA615B72B50412659392316902C95CFD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488320, "uuid": "8c6905d0-964f-4430-93cc-8df120ff88c4", "value": "768:ACG/rJv+tqC3Y+B4JmDGo3ZXelv3YmFAtM5inm+Fg:rGtv+tzMJmDGuUvhFzo1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488320, "uuid": "1269b02a-2fd1-4118-a0fc-749f403711fb", "value": 29452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488320, "uuid": "82d9ba3c-eaa0-4215-ab06-c03da73c810c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488320, "uuid": "d8436ef9-70b9-4aff-935d-ae85b5bd49b5", "value": "f88109c730e14dde4db747e338f9857e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dcbab2-9402-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645549966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549966, "uuid": "0999f910-8375-4160-8804-63220e93d518", "comment": "Malware payload", "value": "ac332e8b1aa64b31caf1518050e1e404", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549966, "uuid": "678045dc-f8a2-4e11-8147-ffa57381aadd", "comment": "Malware payload", "value": "7b77c24743b450b0d4c5c30b68dd374873c96b8fe9d3ca0c0e8c14ab2fad6940", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549966, "uuid": "5f494374-afec-4468-a723-8200169a4165", "comment": "Malware payload", "value": "c1986f4d4256b280344a97ef5df1b21f6a50b779", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549966, "uuid": "94398683-c22c-4264-b6af-e80b86a1daf9", "comment": "Malware payload", "value": "ed6c5947e71b7cfc31d136a68a7913d2f5663898d9817b523b53eae33d8b9eb0ec5b5492509c1acfc984f5f490f551e8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549966, "uuid": "059e6ef5-d168-44cf-9ee2-966a9f202396", "value": "T124930769B681C95BCA5807344CD7CBF67227BC424E7987473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549966, "uuid": "33e8335e-de4e-4b8e-8b10-7a33b6dde5c3", "value": "1536:5yehv7q2Pjx45uoDGTj+5xtekEvi8/dg98EsAeE9jbDXQ4YFkWvgrPE4nWHPNc2e:5yehv7q2Pjx45uoDGTj+5xtekEvi8/du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549966, "uuid": "cb30ae9a-f3b8-4685-9132-aedd3bc44a81", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549966, "uuid": "c56859f0-b5e4-4b2d-8fe7-77168f9729aa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549966, "uuid": "30e0a452-7bfb-4be3-b37e-21e816ce330b", "value": "tmpeil2vlj3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3352ba66-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490071, "uuid": "a83ceb45-2559-4da7-b478-cc63d3c92f22", "comment": "Malware payload (Mirai)", "value": "228b8ddedc2c1cb747956cfd7dd67fe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490071, "uuid": "1c0668bd-88ad-4cd0-b7f1-8155b4817dbe", "comment": "Malware payload (Mirai)", "value": "7b953a771aad6d7663f70fa67007599e42fd8bd9b744642859a00484b9a3570c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490071, "uuid": "858e65ce-430a-4825-8267-c0901fab3f71", "comment": "Malware payload (Mirai)", "value": "16022b55e867ff4250b08f9869b675fbef4fff76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490071, "uuid": "27a13052-2be3-4b23-99b6-73b5299b830e", "comment": "Malware payload (Mirai)", "value": "9ef30b45fb4c0780f65cd6954e7d987db05c90e29867ae906b3ee76a973c81b241f229308e33c74d05715daaa11137ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490071, "uuid": "52bbf82d-9d90-43ef-89de-00086e1fcc66", "value": "T103D2D051645AFCB2C630C870ED2DC7C77A76E5F0A6E1F21B4A7095794D8EA1862E80E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490071, "uuid": "1fc236e6-7ded-4154-a3d5-f384c5df0475", "value": "768:EwS8eYJmKHkEhu165oGcSDfFSJz+ukUU6K/5s3Uoz9:EAemNEEI1soHSDfFSJz+sKMz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490071, "uuid": "dc998a72-f615-41c8-b5d9-681eebced1c6", "value": 29532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490071, "uuid": "392346ed-7813-4f12-8b88-93eda6cb29b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490071, "uuid": "369334f5-41cf-458f-9f50-939547aab254", "value": "228b8ddedc2c1cb747956cfd7dd67fe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8523f7df-9392-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645501804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501804, "uuid": "81357aa3-6cbc-4396-a885-291d5a3683c5", "comment": "Malware payload (Mirai)", "value": "e012c2e1dadc0ecb5429eb66ff8b49e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501804, "uuid": "c1d23e07-1c5b-468d-bb27-0b87588692f3", "comment": "Malware payload (Mirai)", "value": "7bf2f19959f13932259ca649fe3d3355151e9313122c296b9f2012a98316b7fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501804, "uuid": "543aafff-6fb2-43f8-b330-2ff314a72ab8", "comment": "Malware payload (Mirai)", "value": "9653bb67f7d1ea6a726eaf96b299aff4399dc6ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501804, "uuid": "83999abf-4dca-4ada-8163-d87fb15d02d4", "comment": "Malware payload (Mirai)", "value": "c081cc44fe216e40de44daf0f58c635d787f2170cbeafd6fedd352a00cb04269a46c8ff502bd335caecdaa89179c27a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501804, "uuid": "3c6c50d7-7fad-429a-bf8d-dd0221e2721b", "value": "T16C144B47E6919B53C5C62BB6FA9F41023323DB94E3EB3302D8286BF43F4669E1E52505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501804, "uuid": "745213cb-b0c3-4d26-bb28-11f9fc777079", "value": "3072:4q2mXYUWCamLAqkX5bd2ixEN/o5OgD9qZrJFTZW2gwM/9EQmsm2whyKx8TNt:46XY5CawJkX5bd2ieN/YD9qZDTZW2fMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645501804, "uuid": "d46cfbf8-7538-45e1-ba00-7c3cf812b74e", "value": 195034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645501804, "uuid": "5358ebc3-7df4-482d-a8d5-69457bb176a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501804, "uuid": "a7966867-4b8a-4076-ac91-4719f44a4b5f", "value": "arm7.cloudbot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fee764-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528168, "uuid": "db9dd983-ef23-4a7a-9e78-7fd9baec2cdf", "comment": "Malware payload (Mirai)", "value": "7f914d57ff80d53c2ae737b686a5fc50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528168, "uuid": "58b052d4-bfca-41e5-a441-06f85d0aa00f", "comment": "Malware payload (Mirai)", "value": "7bf5b9e6651992be07c2334f5e9a83aae0ecacdf44bdea5085a7b524340876c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528168, "uuid": "efd4423a-4e2f-46c4-b127-9d704f247f18", "comment": "Malware payload (Mirai)", "value": "9915c99e9729538bd938bdbbe2df4b26db03369f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528168, "uuid": "eb43505c-c335-412c-aeb3-76fe5e6d07ee", "comment": "Malware payload (Mirai)", "value": "40e4589e7dabf910a92c2952abd2f79c44b63ee4276de01c9e373d4dd3f8c763dd760d7aad36c57dc47bbd403e28b7ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528168, "uuid": "ccb2f0eb-0e02-42c2-8302-5be18a016bf8", "value": "T1CC435CC59563E9FCDC1019353077FF7656B6E93F1028EBC7D7A8A932A941A02D80728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528168, "uuid": "e68219bb-56cd-4e8c-8a87-b08df00445d5", "value": "1536:36Ew7hWCbZ6OzptrGP85wXyzGWTF+bt+Rc:C1W4Z6OzP4NXyzGWp+bQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528168, "uuid": "d287b8ca-da00-4645-9323-52c49566aa88", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528168, "uuid": "950d15fb-6d2b-4619-95c3-902a38607861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528168, "uuid": "2f257ca3-fc19-4789-926d-25f52e7f9b7e", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec86b3c5-939b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645505843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505843, "uuid": "45820213-b1cc-447e-a1b7-749825641c21", "comment": "Malware payload", "value": "56987739203c33d2ae1311bd99422fc3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505843, "uuid": "ffb6b52e-b783-4148-a2d1-7143cb5adf95", "comment": "Malware payload", "value": "7c414f9241f0fe0539c6036ca5303576509e16983426aed658e3c3c446c121b5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505843, "uuid": "651adc87-3183-457f-ad63-d0a2f1fb51a7", "comment": "Malware payload", "value": "eabf9bc7f64a41e48f45aa526e30d802380e78b2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505843, "uuid": "0a036c82-a321-49ed-9714-df992730f3c0", "comment": "Malware payload", "value": "0e092daee666e4724813440d31e930ab5b2183d43b3432c3d77e98a6d4ef44bd2e36d8192d16a3fd44c57336390c5993", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505843, "uuid": "f9d930a5-ef28-4285-b40d-ddd3a040b91c", "value": "T17D821F5629060BA2700325F053FABA5AF70AD89B37D855FE50E9135FEB80F543A3E1A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505843, "uuid": "3e074d70-97a9-42d1-b2ea-c478fb737649", "value": "192:3dgeYa+3eRTtWq1vHaO0if2kZ3QEEQ58Eda:N7YPCBjUI2kdQLQ6Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505843, "uuid": "50f51cd1-c9d8-45c3-a1a0-2dcd685dba86", "value": 19032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505843, "uuid": "77d8453f-fe26-4235-b15b-55e5e0befeb8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505843, "uuid": "2e72e267-4729-4602-8903-efd95310a403", "value": "xmrig.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5ebee6-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1645515968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515968, "uuid": "084c1a4e-9dc7-48c7-9d16-403211b1ea2b", "comment": "Malware payload (STRRAT)", "value": "ef9f5b4a6c33c916bc9ef517e5545ed4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515968, "uuid": "f88fdb81-53bb-4450-9986-2267a5d65b72", "comment": "Malware payload (STRRAT)", "value": "7ccc38e2616bfb5aef446213a4cab27cffd99e91ba1e035857344a8d5c9454b3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515968, "uuid": "87f64d2a-1620-44eb-b4a4-20bf607b73b6", "comment": "Malware payload (STRRAT)", "value": "4d4a56dc34e6938002f6867a96cb2c5143a8ec68", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515968, "uuid": "6c3eaa6e-070c-451e-8de8-b0cc16a179a9", "comment": "Malware payload (STRRAT)", "value": "c6a01f0c624eaf63db63c8e381d8617e519f32df1f0e3540d880c9fae517b00c8b6e1f47fb7eab2a6a7d3f233cb68f4f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515968, "uuid": "b6c92aec-d845-428d-91eb-12f953397bd2", "value": "T114F3F1BA7E9EEDA0E4434532A11485B35B4D449ED01EE00BA5FC090A6AB5D6C1F0FBDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515968, "uuid": "0ab2209a-9f0b-4c48-a87d-d05fda3ac83c", "value": "3072:u0p+u3GfFRigUP7Azo8DryoXNgcliSWb3x8AeRE81/mHdQ:yyGCB8BXZCb3x8hE81/wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645515968, "uuid": "ec239536-a65d-44d8-b014-c257ed431f3e", "value": 164866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645515968, "uuid": "d03d0560-d8a8-4551-94ba-ff00e6573b04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515968, "uuid": "bad499af-e845-43bb-830f-5fa6effc0b8a", "value": "194291014-215139-sanlccjavap0003-1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33901e77-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514123, "uuid": "6988946d-c3c1-4848-a6a3-2711f733e705", "comment": "Malware payload (Formbook)", "value": "354ca64d34087ef21429760c19cd3652", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514123, "uuid": "67e2653a-cf9a-432a-8da3-b35114de1855", "comment": "Malware payload (Formbook)", "value": "7cd290313972faad40bccb6485984de8f954702ede0a3c2f9b04a684d181f6ae", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514123, "uuid": "55129f2d-a715-43c0-bfc0-0718a474ba16", "comment": "Malware payload (Formbook)", "value": "0ce736d3a0e219ece53324d169f4dfe920de87d4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514123, "uuid": "08347ba8-4e21-49b5-8d21-053552c58b6c", "comment": "Malware payload (Formbook)", "value": "7804459396b388c4a0a9279a01180dfd3b19dcba61361d6d7370148db2f7760fea7eb17479b05680b350a48e75bdbcdd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514123, "uuid": "f4886c9b-5cb7-4e97-b3a9-495bfc76d536", "value": "T16F9568F0AD01D4C1F5BE5B6AF2FD3948A1343217EBC94A4A00E7E5552EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514123, "uuid": "0576b274-54d6-4fed-ba52-d93f78b6acb8", "value": "12288:/6giF3nLr0IRIw+//ay0/EFUHnrtIJBa/BtfOLaZQ1:ylF0Ixuay0/ECGJSfOLT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514123, "uuid": "62928da8-98c3-4944-b9cd-c25d5e0bab43", "value": 1961500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514123, "uuid": "58606d32-75bd-4729-bd3c-e0c0c4fbcb47", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514123, "uuid": "fb697998-ae23-473f-b358-da361ef245e4", "value": "HD FILTRO_06-A.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8297852-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645514802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514802, "uuid": "81eef60a-be21-40e5-87a1-517581236340", "comment": "Malware payload", "value": "affc08159a895e4728429ae166bcc1a4", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514802, "uuid": "b453e82f-133d-409a-a224-20b24e904f4f", "comment": "Malware payload", "value": "7d8c08857496c3067eb958925f8444f07bf04be18e307226a04926bad76e98f7", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514802, "uuid": "c80893d2-cbc1-4d86-aa45-aa59a441fd27", "comment": "Malware payload", "value": "8dcde1f45def304cdd241b6c9e8b4e123a3c4092", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514802, "uuid": "4abb5ba0-9746-48dc-b192-ef479194b3eb", "comment": "Malware payload", "value": "933eae33ecb9ef50016ce670f4a4ced43fe7c432eede57b6338743a704ab805e5e943b1c02b2f8f44da5807113c0c466", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514802, "uuid": "10e4bd61-f5a2-4212-9300-3ea8b528a7c6", "value": "T11B23C02DC5011B16C6736939C47994E209778C1BA11849CFD5EA7E8B0694E8B3F4FFC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514802, "uuid": "84963bc3-466e-4eaf-9da4-6545626c6468", "value": "768:iqs0RD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnt:i2JqHt7NJECQFfqAXFw58gNOE9DFanVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514802, "uuid": "11175ecf-9f85-4f33-9679-b5a1d7e08a8b", "value": 48021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514802, "uuid": "791b6e5d-5c61-4cbc-ba82-4c38d5c33db2", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514802, "uuid": "55bd0fc1-674c-47e5-a58e-30db95c8ee18", "value": "PO.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f51f7d-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503982, "uuid": "c17f4e1e-6618-4693-b303-a7ad83372c1f", "comment": "Malware payload (Mirai)", "value": "3fbb8e5421e26edfbcc7c13e91add2d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503982, "uuid": "389faa2e-4209-43bc-b7e1-de564144f1da", "comment": "Malware payload (Mirai)", "value": "7df138cbe66cda784f707333f2fbfe5f0aa2d4a100b859d72dbec171007c32c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503982, "uuid": "2ebc9bdc-ab0b-4e24-bd50-f506f754a278", "comment": "Malware payload (Mirai)", "value": "2974901bdd89d25208fe52e945803587d561d643", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503982, "uuid": "b28be61b-0ee6-4bb8-865e-f17b5a771aca", "comment": "Malware payload (Mirai)", "value": "ee77aca16aef1a38b6e79fe71fa0d8b4808efd9dd6f926bc24a77cbb117a22370393d493e58967b99e80038a9cd7f46f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503982, "uuid": "6c75538d-b713-4a0c-824b-be86a5151e72", "value": "T1FFC3B61E2E729FBFF66CC37497B75A20A76D63C222F48181D1ACC5142E6024E645FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503982, "uuid": "99af632f-2350-4d16-b618-3a950090e345", "value": "3072:e0v8I+J4xfDBbKxFelnl7Bs6prK5MC+OF:dv8IS4xfDoHoll5rKSCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503982, "uuid": "608b1152-d7f9-49d7-986c-6ee81350fd32", "value": 127536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503982, "uuid": "2b461086-e5dd-4f71-9fa6-5f911d9f204f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503982, "uuid": "ebcad851-86c2-4cf4-be91-1c69a01f56f9", "value": "3fbb8e5421e26edfbcc7c13e91add2d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc922b0b-93cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645526808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526808, "uuid": "3687d00a-391f-4669-ba2b-50bcdc67457f", "comment": "Malware payload (Loki)", "value": "b2a84c18cbf7efa154606d764434660b", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526808, "uuid": "abbca8b9-aa92-4ba1-bc38-fca30cfc2434", "comment": "Malware payload (Loki)", "value": "7e93ddb91a78bfb8d00692a1c8f816a8ec49e598500b69e74a05b039bfbf4f73", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526808, "uuid": "a3784a40-1d4f-4b3c-aa24-eb2f37e0af88", "comment": "Malware payload (Loki)", "value": "db668267b4b52b51704861b755c5630be31f3f0b", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526808, "uuid": "81bc1382-fae3-4292-9b8c-1232b60c0ed2", "comment": "Malware payload (Loki)", "value": "7943bb3b421fc7a91dac7126bf09c8e631980789f0a9e555506d785271100ab11c50294d582c6071adadcff2af4cfde7", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526808, "uuid": "a8956526-0f4b-476e-82ee-d24a98d803f6", "value": "T11FD423A9C812BE05E1B4849BF991A4F3BFBB371A330DFF4E211A7409061A7F1596811F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526808, "uuid": "6a21cda1-fd6a-40dc-87de-8a877c96ec11", "value": "12288:/kcykLUS1aZ3X6PaMLuvcykfFwMwkFW0MJvuTzz/2/SIlkmMTp/qz:/skYS1qn6PaMxyeFhM4mfXMTpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645526808, "uuid": "70bf05a5-96de-43d3-91fe-a7c2a113e4a4", "value": 604287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645526808, "uuid": "4a93e3a2-526c-46b2-8a75-2e6fa24343eb", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526808, "uuid": "09a39a8d-d437-4264-8bd5-f00c077d721a", "value": "Samples Copy.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353605ef-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517562, "uuid": "23d250cd-cd57-4acc-a5d7-00dc9a713f37", "comment": "Malware payload", "value": "43377b304c03cf7956021bd4d140d972", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517562, "uuid": "5ee0ba33-2265-4e69-8174-8381a0373576", "comment": "Malware payload", "value": "7ea7b20b87ded3c297ec0890ee8a396427d70caf983b42f479d8fad38629b684", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517562, "uuid": "dfe79ac9-430c-41c5-b63c-a19f2d8e912a", "comment": "Malware payload", "value": "b0c7f03d8837171169030309a7eb6786f0236a59", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517562, "uuid": "0f045ca7-0634-44a1-ab60-eaf74050f01a", "comment": "Malware payload", "value": "a4c0fb3d766eccb024e5256f7f805a809dde7d67d75aca8d397dab1bfd618d1dc67c59d80cb9f59913d909948936265c", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517562, "uuid": "de6837c0-1bc5-4768-b947-33771e45c227", "value": "T11AE0C214C9CB90D280F91D8C8EEB3BF3A406A005CB284C7E1B0300E77AA559FA754A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517562, "uuid": "3506660d-a2e9-4a7d-be72-bf8fdaf95e47", "value": "6:h+9Xshc99XsdezSU84BA2JF8402Go2m288F84i:gVuc9VmdU7tb7bGvv8A7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517562, "uuid": "29f4262f-33b0-4ea7-b27b-708c0e073503", "value": 313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517562, "uuid": "3fc46912-43ef-462c-b420-8049c428a205", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517562, "uuid": "7a55aff3-3c83-4ba7-af08-877b047dd561", "value": "7ea7b20b87ded3c297ec0890ee8a396427d70caf983b42f479d8fad38629b684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c52b87-93d1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645528681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528681, "uuid": "1709c901-7dd6-4f4b-89c6-21343190fc75", "comment": "Malware payload (AgentTesla)", "value": "264323b1c97242f4f07cb9fd6648e142", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528681, "uuid": "e8109758-5696-473e-a443-5ac97882f8ac", "comment": "Malware payload (AgentTesla)", "value": "7ef0589e9801c888cb381f368e70374cb9d4f8567a50aa49a247e033e9780206", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528681, "uuid": "988b9a90-35c9-43db-a74c-ea535c0452a1", "comment": "Malware payload (AgentTesla)", "value": "c91b4653ecd20b17f6f5dde14871be1451ce0212", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528681, "uuid": "16d6cecd-fd87-44c8-94b5-bccfecd207eb", "comment": "Malware payload (AgentTesla)", "value": "819e616311862f38295cc31c135ae7962747205f3aeb9302e77ff9008b724c2062fe58ca1d8e4ee9b3cb320a7d5bd3c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528681, "uuid": "6e5b89d4-94bd-442a-83bc-7c9be2b62325", "value": "T15D15CF542AAB5F3CF1B94BB648D4ECB4F7A9F7231C05F37E78402586CA52B418D422B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528681, "uuid": "68ca679e-744f-4239-987b-8b5786906ba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528681, "uuid": "85fabc63-82b4-4ad9-b627-79fbad5baad4", "value": "24576:xuNW8Mu/XL27w3T1nIIt1EF33yd2NkEB:K9V3T1n5t18nydHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528681, "uuid": "d185e321-f0d3-4d7c-b186-ff7e709f1414", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528681, "uuid": "a14583ed-0cfb-4493-b53f-39d6163ab206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528681, "uuid": "2301bbcc-9c2c-4435-8fc7-654edc4d7f3a", "value": "payment of ($288273.63)...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251c967c-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517535, "uuid": "9bedad51-31ff-4d15-affc-b526acc85c45", "comment": "Malware payload", "value": "fcbf1def005b74867d4becd25eaed35c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517535, "uuid": "81e5c053-f169-4882-9861-1f4a4e1c7a6b", "comment": "Malware payload", "value": "8075542c1af888a0b4dce564436922c342bb83949d984c73331f6b53673b4b14", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517535, "uuid": "cfef7741-5412-431a-9db9-2ad6fd3a8ee2", "comment": "Malware payload", "value": "b6ebb449b96126ccdb8265a3295816d8abd9c32e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517535, "uuid": "31d086a4-d1c6-49fb-a84d-89d4315bf7d1", "comment": "Malware payload", "value": "e81b709afe6de242a7f08da7a707980efba421fee04c910ce7da16ba766a7ad819bf8e231bf7b7dd9c4d936a8f80a07c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517535, "uuid": "b7f874ad-bbc8-4ebb-93bf-16275ca3da61", "value": "T1BA165B13B265753AF06B0A3F4937A65899BB76712E228C5BD7F0084C8E3D540FA3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517535, "uuid": "e6a59f54-f49e-4058-bdcf-05042d0629a0", "value": "49152:U8xF/SagpeVhshD4S+xsRvhlMWXSfLK+J2RqqTQQa1gZPueGY73A:RF/S6Txs5i2+WqLAUeGY7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517535, "uuid": "6e8bc28f-ed5f-42b2-972c-2dd3cc0d8c87", "value": 4137984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517535, "uuid": "e7567758-4789-446c-9000-e160001ff3e0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517535, "uuid": "4e1670e4-9262-4e0b-8266-3da65b14f72c", "value": "Archivo.FactEndes02102.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a63b5d-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645513930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513930, "uuid": "1f3157d7-20de-4ac4-8206-d87303e23256", "comment": "Malware payload (SnakeKeylogger)", "value": "3ed50fbbf5cd8697412d051823da3476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513930, "uuid": "40f5844f-0c46-47fc-b315-ec8d7aa83e53", "comment": "Malware payload (SnakeKeylogger)", "value": "81a708ff83fe551dd6813d0d98e982dbb8118b501801da8b27964a6e951cb994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513930, "uuid": "26cad7b7-7856-4e93-add5-90d1fafcff64", "comment": "Malware payload (SnakeKeylogger)", "value": "2e323b3321c527c293e012ed036c7dc4a7416379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513930, "uuid": "876b807c-3d6a-438f-a5c8-3c0b81c275a4", "comment": "Malware payload (SnakeKeylogger)", "value": "3c142d3c2fb482c0a7320bbf5633639c32508f9f9bc3595ce87bf058a275e5b52b55f63ac7fff9e39fb8176ff304876b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513930, "uuid": "64112cba-3dd0-4535-a09f-f0a6a43c1e90", "value": "T1B9C4D0A410F784B6CD5EDAFFF821D6082F74E56F9606F2FA0984907800BE7D10A9567B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513930, "uuid": "693e6efb-41aa-49e6-b813-ed788ec03eb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513930, "uuid": "5bb34748-f063-404c-9872-d77d6d793c0c", "value": "12288:ewxaasVjf1YP+8xIC2Al+YuKYGmLPXJ4oDlikL:VxPsjYWOIfEXAXJ1D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513930, "uuid": "9539148e-7b33-42ee-9b6b-92501e6fa44b", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513930, "uuid": "a807be7c-d2d0-4328-bace-b73d83e1d54c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513930, "uuid": "4d97736d-625c-42c4-bd1b-6deb61b41be2", "value": "3ed50fbbf5cd8697412d051823da3476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffd9aa5-9395-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503057, "uuid": "ec4110b7-140e-4a78-9f03-ca42f009ee45", "comment": "Malware payload (Mirai)", "value": "03441e334e27871a52e5c9bbbf81c4df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503057, "uuid": "3c76c779-4f8b-487b-8709-ecd3ee9d28c6", "comment": "Malware payload (Mirai)", "value": "81e2d3eb092d7c84f8cb5f78deae36b6e1b3e46417d973a593892e8f98b69f31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503057, "uuid": "59040529-02f5-461c-9e39-a87d8a893dc9", "comment": "Malware payload (Mirai)", "value": "7a6254f8dfe5b930df671e0b65874619b47a8252", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503057, "uuid": "716dc56e-9d19-47bd-8a64-d5c46f6c1982", "comment": "Malware payload (Mirai)", "value": "423a8d8eaa37abd857a3df2fe9949f56d7efa9b7cf604be57f4aac47be5e66ba5ce8d55d3503d71dbb060239d183db3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503057, "uuid": "b60f2c1c-0769-4e2d-ac63-7d3e66e5f2a3", "value": "T136C3E70BAB714FFBE8AFEE7751A91B06359C944321EC2B26F674C514F10A50B1AD3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503057, "uuid": "b9e1d037-ca48-40cb-9f87-442af99017d0", "value": "1536:tC8YYAjj9QKvsBNSXDfXG0S5UHvDZsOJAcRlEyYF8ICnsUIX0/I:t7utTfFSsDb1Rl6hT0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503057, "uuid": "91ae1409-9f4e-4974-b2d5-43e8eb79cac2", "value": 127536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503057, "uuid": "4e0190e7-6dc1-4b6c-bc5f-e716fcaff988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503057, "uuid": "37fbf0e5-aa05-41e8-8f2c-441af1625517", "value": "03441e334e27871a52e5c9bbbf81c4df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93da0096-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554228, "uuid": "b41f2eee-8813-421d-9fa7-9c95d0461aef", "comment": "Malware payload", "value": "d86348ab677ef59fef7d307ca7ece3ea", "object_relation": "md5", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554228, "uuid": "9a8ac8c4-8021-43cd-9eb0-efed212b96bd", "comment": "Malware payload", "value": "834ebbc3312439a9186f81f6b362e0969a3774cc28a8539e7950912b909e82b8", "object_relation": "sha256", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554228, "uuid": "a53fcb67-bc76-4f1f-9f65-49a1776ccbb7", "comment": "Malware payload", "value": "31039006c710e8051a1537f16f6cdac5cab433f3", "object_relation": "sha1", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554228, "uuid": "21acb8ab-de24-4675-977f-420af02bb5dc", "comment": "Malware payload", "value": "42dcba623079e520086070bef961b561b8a1606048a7d84363537070fee7a151a6dcb5d1a899e96348ecc740e5e4d496", "object_relation": "sha3-384", "Tag": [ { "name": "nworm", "colour": "#1305E0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554228, "uuid": "48604870-e9fc-4481-b53a-29987143f149", "value": "T14181B674B42479F38D02FD2DD0E991731E7734344AEBA581882106371EF9DBA27DA293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554228, "uuid": "446ab78d-1a98-4cf7-88d7-59334e386669", "value": "96:lERrjleLz4IYOINpCDwk/pKI7Y/j+hAderriwx7QkquS25:clen4IYOsEwk/pIChAderrvx7QkvSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554228, "uuid": "c79322f1-d7a2-42d0-b906-11e608337bab", "value": 4014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554228, "uuid": "d157d66b-b645-42a4-8aab-36ca3e7d993b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554228, "uuid": "2263ca57-8d97-43d8-916b-c4746ebc6388", "value": "EncKAO.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1832b106-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645527821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645527821, "uuid": "31ba47ee-bbae-445f-bf63-d9837b034a42", "comment": "Malware payload (AgentTesla)", "value": "8563ce9ac17095a15ff35fb11e79949a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645527821, "uuid": "62a3bed8-1dfb-4d24-a32a-4f99c60ee79c", "comment": "Malware payload (AgentTesla)", "value": "83a48b4d9d6b7600a6c597af9bf03368bcf3a6a84be1c0f33f064eea3777d8e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645527821, "uuid": "02c62bb5-c083-4a34-b9de-da68e39f12d4", "comment": "Malware payload (AgentTesla)", "value": "4c929b4009df619086a5dba5c728bba3c5ccadf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645527821, "uuid": "4df10626-033c-4ece-a1eb-7f23afc14f95", "comment": "Malware payload (AgentTesla)", "value": "bdfeda3f3045b25a4a1fb0e45735d0ea2605c7baf24834d869635a40abfc08f52793675e97d44cbc8ef6a6ba255e9efd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645527821, "uuid": "d5b018d7-8c16-43b6-a6ba-206ef031e9c7", "value": "T186356A40A5934F3CF0750EB704E4D956FAD4AEA31C07A3ADBB40F6DDCB33A61984916A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645527821, "uuid": "677234f6-8251-4e1b-b7e2-aa722ee254a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645527821, "uuid": "bf1c792f-d7b5-4eda-9c75-9467b65cc81e", "value": "24576:fLLNv7L254SQCs5nmJByHn+4JUnZidAr:17a54S7J8UZig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645527821, "uuid": "ddf380d3-dfc8-49e4-ab8e-ceb440484dab", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645527821, "uuid": "82595c29-451c-404f-9368-c5b6831e7aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645527821, "uuid": "00ff903d-3bb9-48a0-ad80-841c910a5910", "value": "Vessel's Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f594dde-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645515995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515995, "uuid": "98ffc47c-6acc-4983-9362-885d3dc65c7f", "comment": "Malware payload (Formbook)", "value": "177a65a374f4413afb746bd3fd823460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515995, "uuid": "99b498c3-a187-442e-b6c5-a78c3b3b6b95", "comment": "Malware payload (Formbook)", "value": "83ade97bc0f693761767e687204e11ba7bda7956db304f4a63ca56cab467bd1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515995, "uuid": "75ccf731-6131-40c1-bad2-ba9651eb08e3", "comment": "Malware payload (Formbook)", "value": "d9031f741da7ddac2696ce0ebda743a626ad10a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515995, "uuid": "41a39af0-6db7-4764-8c55-be61b58700ed", "comment": "Malware payload (Formbook)", "value": "f62bb827cda7f234e7a7f8aa64760ffc1a76bc74e24fa55f590a4ad77cab1133a3ca6dff6e3916d954eb73b2a0e5e1c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515995, "uuid": "09fa1470-a14a-4afd-b49b-2c3862751771", "value": "T1D494C02515E2D40ECFA675384F50E9B8A7F94E4E393922C223F7AF9F796DB932540081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515995, "uuid": "e13ce03d-da7f-43a9-a51e-89fc30507429", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515995, "uuid": "f07033f8-45ea-4b1b-8dfb-f3cc6bcdb889", "value": "6144:nxD/wCVPOvwtvNQEEj3n+eE64sFLEt3FZgS2Y80+gYS529aefE:7WIAP+eENsFgTZgq8L6UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645515995, "uuid": "024f44b0-055e-4aaa-97c9-b54925f10f0b", "value": 434880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645515995, "uuid": "74744512-a040-473e-b375-cdce239e45a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515995, "uuid": "2eeff922-ca91-4210-b3c0-01b8e2fcd48a", "value": "IRQ2107799_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a666afb6-93d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531066, "uuid": "b7b20649-dd2a-44ca-a428-cb7c5ffb7fb0", "comment": "Malware payload (Mirai)", "value": "60cc669399cffc5acb43caf88c2bbabe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531066, "uuid": "c1c1002a-f0df-499b-a2dd-28838d30472d", "comment": "Malware payload (Mirai)", "value": "8529aca87241aafbb5348463c7a51a97f77bde9561c08a12e4aeade5e8abe7d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531066, "uuid": "5f50914d-261f-4946-93aa-cb328d6ef618", "comment": "Malware payload (Mirai)", "value": "b1fb3fc939e83b136c022f175e1423118d8c3109", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531066, "uuid": "bf07c22d-afca-4fb7-9464-fd5ae4ff1597", "comment": "Malware payload (Mirai)", "value": "065a67a4dcb602a850a09350e7782cccbf63b2d734bd31f8c92a96a1a8bc6c3efdc44dbde1df701e5035bf8d7c7275b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531066, "uuid": "92685f2b-0600-4aee-8492-86c36f688a5c", "value": "T1C7232A69B884CA46C9D071BBFE0D428D33265799E1FEB3075E256FA227CA4360E3F111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531066, "uuid": "dfe639ba-f199-457d-a0c7-30d9c8c6ddf8", "value": "768:f2Yp/nE0kqf6kLv4YSF/P5kQNP5KmhzkRNVIQnHc+ftpNym/vdPrUKqng7SnxFS7:j0c64QmRvn8ctSuvVIK2gWxFM1B/3Nlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531066, "uuid": "e2481301-65df-4e50-92fd-d5845cb7b041", "value": 46968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531066, "uuid": "f3bd2c09-0349-4bfa-ad0c-4f282e1d6620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531066, "uuid": "914e9a27-742a-49ad-9b9f-2a5a3f49497f", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcafd460-940f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555692, "uuid": "24c3b397-149a-4f98-8681-0c94208fe5da", "comment": "Malware payload", "value": "3052d1815a8fb462d12e5f921fb45d7a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555692, "uuid": "d42c1d3d-a8be-40cc-af79-17d4aa5801fb", "comment": "Malware payload", "value": "85dca73c1b2716a70e661b3979df8c61bdf10273e21272e980c492a7c254bcef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555692, "uuid": "7b9d3639-5be4-4384-897f-0e582e930567", "comment": "Malware payload", "value": "b117b81493d5f1dae5ae12ad4ecc84bff3421590", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555692, "uuid": "18ec3977-640c-418f-bf3b-7b5aeee723cb", "comment": "Malware payload", "value": "f60f0b634245e600bcd92bd34d1343e62552166fba67b0e6cd0b0ee0d8ba9dbf50a87e960593b95ae717c0240cc1eedf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555692, "uuid": "9d8bc6c1-ac13-437c-9e76-8a1b3ff934c6", "value": "T181930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555692, "uuid": "e4fcad9b-af1e-46e9-8152-bd718fed2312", "value": "1536:yyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQxqkWvgrPE4nWHPNc2AF:yyehv7q2Pjx45uoDGTj+5xtekEvi8/dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555692, "uuid": "4b62928b-09ae-459d-9ab0-d64414adc4d7", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555692, "uuid": "ceb4747c-1e23-4c2a-b867-f4eefec1afa5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555692, "uuid": "5b1a2725-62ed-4c79-a6be-26fc44588259", "value": "tmplslcsx65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae295fc1-940d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554701, "uuid": "946f7dbe-dc5f-472e-ae7a-ff9979744588", "comment": "Malware payload", "value": "720e6d66ef6afaffb09e19f29d8bee7e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554701, "uuid": "3f5aee30-eed9-401d-95a6-21f8207ad6fa", "comment": "Malware payload", "value": "85f5c91122a3f2496e26f0c9c8841b46e3427184969533399664c93c525d2397", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554701, "uuid": "63378280-75e9-4d6c-8087-eb3278d6f68a", "comment": "Malware payload", "value": "9c5daedc1aaa19a997d49466b6a24477673a73ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554701, "uuid": "9e3122c8-7149-4702-9d60-18b2a4a1f0a1", "comment": "Malware payload", "value": "04c48f3a693ed7ca71dd2cc6ec7cd295f79ef8fcee063f916fa978749b53dbd7603e9d6dc4270df1589314a3c6eeefe0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554701, "uuid": "ec1bbd69-a5b4-47a1-a722-3350124bc99d", "value": "T15C930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554701, "uuid": "cad00aaa-58ae-4be7-84f4-f5ebbb4078f7", "value": "1536:5yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGDkWvgrPE4nWHPNc2Ap:5yehv7q2Pjx45uoDGTj+5xtekEvi8/dB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554701, "uuid": "474e9b87-68b9-46aa-a658-a9e5e8b6ec3e", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554701, "uuid": "43aa4ed8-6a83-43f0-a525-d5e7cd19a863", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554701, "uuid": "c39b4b84-942f-4b02-a1b2-160374800237", "value": "tmpahz48m02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c720eef5-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492037, "uuid": "cfed0c93-6110-4be0-bb5a-e8f1171e75a2", "comment": "Malware payload (Mirai)", "value": "dfc60a0ad53297b7bf2f863ec006f2e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492037, "uuid": "f0809fa3-2baa-407b-9d5a-16d42f624d03", "comment": "Malware payload (Mirai)", "value": "867919ae86e16e31b4288fdc3f67a1228ecd7abb6a83fbe126f907517357e0e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492037, "uuid": "fe8018e3-f688-45f3-8a31-8ce626715fcb", "comment": "Malware payload (Mirai)", "value": "54fb4258bd4af833d5b015a12607f7255cc41e7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492037, "uuid": "145f6d45-7cee-4628-ae76-14912b83eaec", "comment": "Malware payload (Mirai)", "value": "468ffd2a1348b649797e1d3b3b442a700b430a916e271ea20621afc05904cf5d9d3e9422f57f2848997d4d52fa325ddf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492037, "uuid": "566d7faf-292f-4336-b5b7-3da1972a141d", "value": "T1DE734A3179761D27C0E1A03A22F74724B2F2A39E25B8C61E7D720E8DBF6094475636F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492037, "uuid": "7fc9875c-1468-441a-a924-d90ceabf24c8", "value": "1536:dCQ8F0FGL2CcDkRSkOtB02hjaYYT5PJtJaf:tfkLZs9021YNxaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492037, "uuid": "db462cce-59f6-4e24-b196-d36c95f1baff", "value": 78936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492037, "uuid": "c19cd8aa-94c0-434a-9503-97e3852fe100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492037, "uuid": "c42c2625-1161-444d-bc6f-e6e46fe5985f", "value": "dfc60a0ad53297b7bf2f863ec006f2e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9f30b4-93af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645514113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514113, "uuid": "28c0a62d-e7f4-4e4d-ba33-fe0d8d699284", "comment": "Malware payload", "value": "7d447ae610e921fc6e5473dafd8e3ddb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514113, "uuid": "253fdf90-3251-420d-a58c-0e0358455c1e", "comment": "Malware payload", "value": "8741d5ed80b4390b11897114ce6cb74af88cc857f0e3f0ba7d530edaff2a1b3d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514113, "uuid": "e9fef949-750f-465d-9982-62ad12f5d1e6", "comment": "Malware payload", "value": "11c1f8dbbb7f8e0e9bb23fdb99e2da467d62c876", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514113, "uuid": "233318e9-2827-42e4-8a8e-bcb5a2022846", "comment": "Malware payload", "value": "85eaf53bfe3512f4adb210ed3969216e02d6803ed2626a5367b2740dedcf5cfe93adce001f1c9a41986f4d37585d485c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514113, "uuid": "ba6d6d56-2bcd-47d7-88d3-455a18a17a97", "value": "T13E24B0F06780D8D2EA9E9B97955A6E9C1736317BAEC614CC4042FFDA2E733418E0DC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514113, "uuid": "28eff741-b9dd-42dd-a004-812b970206ab", "value": "1536:QJc8HFaY5+MfKrBgP2i8JP7IQnv7vfbVu9p56XxXM+9lzvowloRERwznLpGIgHDJ:Qz56Xb5AI9T/9Z9ptA0FxEO7157Nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514113, "uuid": "a40d08d7-ade1-4c62-9de9-0ffa336b5641", "value": 227384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514113, "uuid": "7e8c8cea-2b16-4456-b138-7c28bb7260c9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514113, "uuid": "a8460e47-9ea9-41ba-b223-7a691708dc32", "value": "G22-02-22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1853df-93c2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645522596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522596, "uuid": "b7cddcc0-8653-45ee-a97e-6280b8262ee9", "comment": "Malware payload (Mirai)", "value": "c8b173bbc45abb16fac436d316a314c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522596, "uuid": "154bd70a-072e-4ffd-b6bd-3365ae0490ff", "comment": "Malware payload (Mirai)", "value": "87aaac1f10ff38a773f271db49040496fa695a86898995c92270d8f59e589de9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522596, "uuid": "f5e4e2c8-5a68-4244-97c8-1176c03367b8", "comment": "Malware payload (Mirai)", "value": "0e8f49df3567cbb3fbd641fe95ff6a164382d5a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522596, "uuid": "e2efdc79-e849-4226-a805-8f9459e9f3ce", "comment": "Malware payload (Mirai)", "value": "1cb77536a229a1db7f13538c19ff555168909fe77ea9e09f1385ee005f9d4c0371fa751af9cca92d7b6080b3f204a380", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522596, "uuid": "d0165622-78ff-44fa-98fb-cd02be86b6fa", "value": "T199C2D15DA4A95D8CC65C88BF41AF2774E940D2F096CACF4BC3205F48E679B0F3984878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522596, "uuid": "7e06483f-675e-4079-96cc-8d28130a148a", "value": "768:NwzrpjQyxWlyqXO9oH2Syw6cwXxntPWTNV8:SRQyxWQqBy7fBntmNV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645522596, "uuid": "066a3a74-8c2a-4b62-bdef-2bdc6470f57c", "value": 27772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645522596, "uuid": "54eaa28a-ace6-44da-abd0-1725863e26b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522596, "uuid": "ce82edb2-7305-4441-b35d-12562759ed0c", "value": "c8b173bbc45abb16fac436d316a314c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa29ecc-93ba-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645519101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645519101, "uuid": "28c527b8-2afe-414b-b53f-a884745e9d32", "comment": "Malware payload (GuLoader)", "value": "3a775fc493f5b67eda09eb9ef72dc787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645519101, "uuid": "ad30bb91-d96a-460c-abfd-44e271ca10a5", "comment": "Malware payload (GuLoader)", "value": "891447d38e98041530423dbe6f025a12dc3202af931d079cfe02af2cdf5dae68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645519101, "uuid": "8041a498-f2e5-42c8-a02e-a22d21b67644", "comment": "Malware payload (GuLoader)", "value": "5e395f0621ccca65dccf3a5d55d18d34007784eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645519101, "uuid": "f3b0ca13-a1f6-404f-93f1-ee3f6396d676", "comment": "Malware payload (GuLoader)", "value": "311884004cb646b861dee93d0a28ecbc95f5503cdd12a80d6ec37ee2559a716297aefe9d00de2b47045f17731b6895b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645519101, "uuid": "15c5201d-e7f3-488b-98a1-ac1cdf4f7ba4", "value": "T139840229EB50D062D5E14E356D35936A8EB9EF652D76538737C3BFAE30321C14A0E342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645519101, "uuid": "2a1a1544-e959-4373-a4d2-65893144ffc6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645519101, "uuid": "e2172c97-2e60-46cd-90b5-1ee8b832c5ab", "value": "6144:wNeZGuOwoXx1OQFNuiSfUozTI0qHjEn8cFUekD9UqtJr0iN9s:wNoO9sfXI3jE8cF1A9ZJr0iLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645519101, "uuid": "b70b21cd-b4d7-4451-8d14-8fc623bae54f", "value": 383815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645519101, "uuid": "0131e136-5de8-4ece-982b-a217ec7d76cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645519101, "uuid": "ee68da63-8fce-4d7c-9dab-43175750a382", "value": "New Order 00027748585 02222022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b7acb3-93af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645514073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514073, "uuid": "5eba4024-3674-4524-8c00-2313e974d85f", "comment": "Malware payload", "value": "2fac10e7a4c50d7c8c3ce50826126e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514073, "uuid": "0ef977be-be53-456e-b47c-6b6e974a2bab", "comment": "Malware payload", "value": "891ed86b4e99ab1be5772f8440f56de0f1f952149283d5613ef8fcda23c509f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514073, "uuid": "a6fb88e5-a055-41d2-9f71-03ed060e9a76", "comment": "Malware payload", "value": "397531eabe73ab87273a4da9fefaa2cd668a216b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514073, "uuid": "95ffc516-b7af-4d42-a171-73c134c94912", "comment": "Malware payload", "value": "1cccfd13b4acfe60b8546b2cfc57149e6e5f5acd20a8a0e9c9bf1fe605099ec9c7a11fc211494ae38cce67ff24f77b54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514073, "uuid": "07610c83-2588-42e0-a39e-78925d8596b7", "value": "T19F9623FD6244331CC41F84309437FC59B1B5592E0EE9CABAB6D73BD027AA425DA02F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514073, "uuid": "25296d1f-a747-495a-8749-5409bcd951a8", "value": "2f084553d02ee9faa371daf024a1480c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514073, "uuid": "00a654ee-37b2-41d4-a84b-84d5524c5c0e", "value": "196608:XzSWXaWcuAuLfCfvIp3D6VJLosYFz6txoprKCjSYPZjylLUvlao:Ot3IxCqBux69rzEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514073, "uuid": "d2d92592-0842-4155-a93f-2ed69ff04346", "value": 8652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514073, "uuid": "7ca6a108-f178-4632-af27-19355f1773c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514073, "uuid": "c0d58eb9-69dd-48fa-983a-425fb2fd5e5f", "value": "2fac10e7a4c50d7c8c3ce50826126e01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205548b5-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517527, "uuid": "a9b2e5e6-4060-4983-8117-92472bfc84ad", "comment": "Malware payload", "value": "330f32836c0ea231ceedfdb076845610", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517527, "uuid": "27a4c963-f090-4d97-ae2e-4366b4cc21fa", "comment": "Malware payload", "value": "8b74c08c33cd8a0cc1eaf822caeaad6b54bc39e4839e575f3c0ece4bb8992408", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517527, "uuid": "f578eebb-891f-43b3-8e4d-8d8d9412c4e9", "comment": "Malware payload", "value": "49392a423224853c10e81622d084f86a296439b3", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517527, "uuid": "30b1bef5-d64e-48bd-967f-eda6abab61fa", "comment": "Malware payload", "value": "ac15e5ea7033f165abcd27deca9deb6026d9ebbc3b973ca3c5a9ee28d821efd89abaf288ff6463a5807c6999944a4ef4", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517527, "uuid": "6cc90d33-1336-440f-967d-cb3490714ce3", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517527, "uuid": "7a802d3c-e439-48af-b4cb-d56c9458c1e5", "value": "3:F1Fy:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517527, "uuid": "e6b6bd5f-e6fa-4130-94e1-770ce5f55fda", "value": 8, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517527, "uuid": "7d6f7024-1883-4dde-b750-ec83cda61b18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517527, "uuid": "5aa18ee3-9f48-4572-be3c-c9996299ecfb", "value": "8b74c08c33cd8a0cc1eaf822caeaad6b54bc39e4839e575f3c0ece4bb8992408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405924cb-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645514574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514574, "uuid": "8add525e-35f0-43cf-9101-da7e1f81f248", "comment": "Malware payload (Smoke Loader)", "value": "64a25432a182a0b0f341bae01a95d4f4", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514574, "uuid": "bc77204c-cccc-42bb-80da-6f294ad7b2ce", "comment": "Malware payload (Smoke Loader)", "value": "8ba7321bd47db2badd6509087bbd95977ee2e6f4cf6de5f851753c6ec82ec8d5", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514574, "uuid": "73376302-6917-4a53-83d5-14b28f177016", "comment": "Malware payload (Smoke Loader)", "value": "334e785009930ffc214e09749a406acae25597d4", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514574, "uuid": "e434a321-8632-4af7-aaaa-c5c01001f0e2", "comment": "Malware payload (Smoke Loader)", "value": "22b1a58dc618dc76f272d7f4666137cc205e0294758ea03e5e47823726f84c641daf240cf3d1920d79e0dda600027842", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514574, "uuid": "1a7dc36f-1dec-4c0e-b488-13243962eef2", "value": "T11264121F37AA25CEE503053EBE9696AF1157FE0DD32A144AAACC3814D933A067DBD701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514574, "uuid": "861ed535-955a-4760-b25a-9afe5dbad64e", "value": "6144:u85XJtkeJzL6T4yqn1M+NA0d+gCPoeBnyy3iHcEe56jrwoHr2:XKEmFaW8BGgSyy3oeUHHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514574, "uuid": "97556778-a4b6-45dc-bed3-8d4b4546b79c", "value": 312232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514574, "uuid": "9ae69e34-a1cf-4004-9536-f0d7802aa388", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514574, "uuid": "5103d31b-5106-4f25-94ef-d89ab61c1a46", "value": "Purchase Order #180222CT24.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61aee856-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517636, "uuid": "2e99ef09-956a-4e1e-bcbd-a7dc2b7fd6dc", "comment": "Malware payload", "value": "1a1736d4e45de374861a10cebcef61ed", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517636, "uuid": "ab9b92a9-715e-4904-90fd-7d589aba8d60", "comment": "Malware payload", "value": "8bdf6e262966a59a7242d279e511dd694467f07d1d76c456a0c26d0db2ec48a8", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517636, "uuid": "46f56501-c13c-4397-9a1f-069c6a191ddb", "comment": "Malware payload", "value": "5dfb313bb3509dce4e2fd1da58e4914d3829a392", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517636, "uuid": "47e63c1c-0b02-4042-a7a9-5aec47ea6dfd", "comment": "Malware payload", "value": "1219e8de8fd3ceeb26b2cc3bc4308ecfbcf62f4dcdace97e5af3f71f3ab3addf090ab20725b3a201d8fb20d87de42c68", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517636, "uuid": "d3d48097-dfa4-44e1-ae6f-a17b738f7a8e", "value": "T1FCC2D706BBEE7765E2FF8B3998B232100A7A7D49D425DB4D2D84204D1DB3B189D52F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517636, "uuid": "1974c501-b6d2-4eb2-9789-7c781f6d812a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517636, "uuid": "753850b7-6012-4400-9b0e-798acfa63e3e", "value": "384:VTC6eAnMSzqkxk7ibgmAg9FEijc59bVbrD1V+uP1sbZCT6T3ch4rk0DNYa0bYHVq:VvDzxEVPZHPEZCTE3cEk0DzKZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517636, "uuid": "3f719756-be0c-4d61-92f8-88dd474f5e8f", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517636, "uuid": "1680d969-7884-4519-b0b8-b812f72c30cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517636, "uuid": "f3120703-aea5-4ffd-81a5-49fbc77bbb3f", "value": "8bdf6e262966a59a7242d279e511dd694467f07d1d76c456a0c26d0db2ec48a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee81cdce-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1645514007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514007, "uuid": "9725af17-60b9-4e9b-9c13-cd27d530579e", "comment": "Malware payload (QuasarRAT)", "value": "90bacca9ab7f4dc9a4706a7b3eb3578b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514007, "uuid": "ec75a330-e558-4082-8829-9b8369fb9c80", "comment": "Malware payload (QuasarRAT)", "value": "8c4111e5ec6ec033ea32e7d40f3c36e16ad50146240dacfc3de6cf8df19e6531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514007, "uuid": "bfbfa47b-8e57-49ba-a4b6-a3e5b9b3dc11", "comment": "Malware payload (QuasarRAT)", "value": "a0fb4ad78fdb0da4483cc3b1e85ccb9f7154329a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514007, "uuid": "9d046707-60f2-47ff-8969-42709ac2d29f", "comment": "Malware payload (QuasarRAT)", "value": "9e905d2df011201bd4d97dd1319c740d281a83c84d550ecf6a7e5726e27e8ec04bfbd760a334c0286c693d572b821faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514007, "uuid": "cab06179-c0d2-4bb2-a73c-8a97754c61f1", "value": "T1CDD5BC1CC2DE6907B94431E43E8FF36241983FA91491B1F8B746823D5D3C6B1BEB9662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514007, "uuid": "53b74068-fda5-4bcb-8e4b-68a7e8a8db49", "value": "bc47ee1cfeae875e3ba469dc385d9490", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514007, "uuid": "fcd2af79-e9e9-44e8-a6fa-0def5afbc321", "value": "24576:8/pP3ScUYJyvCP7hSRthaPFi3d8o1A0+6/UhnuhkeAES2uL:8/F3Lx6BBBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514007, "uuid": "4acc2799-4b67-4140-a77f-4c0f71baf0a7", "value": 2979328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514007, "uuid": "2d074baa-2fb6-4fc5-b883-3a4c093f45e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514007, "uuid": "af6416dc-7b8d-4622-a586-d14f11c62349", "value": "90bacca9ab7f4dc9a4706a7b3eb3578b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac786b10-9399-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645504877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504877, "uuid": "51f367ef-ac20-4f9e-9d95-d6f57596be24", "comment": "Malware payload", "value": "295ddd46028a1cd774b623d0eb0f49e9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504877, "uuid": "af209497-9fcd-4aca-80a3-f35eb81b6f43", "comment": "Malware payload", "value": "8c72c46fb99ed70fa27593bb2dd9fac34f15974086016363cb4764b86bf0dd75", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504877, "uuid": "4efd4877-de02-47a7-adae-d08424501ce6", "comment": "Malware payload", "value": "369c9b0f62f55339ba1994693e4992baf3706599", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504877, "uuid": "949d5ed0-f244-4122-84e4-4903fc890137", "comment": "Malware payload", "value": "c9a7eaf94ee6d9616d996a0b5ed2db7b12a4ff98f7650f2b0ee36bb0c331264a7661802006397df9db386b7d9428f5ed", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "forkbomb", "colour": "#272789", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504877, "uuid": "3f46187f-2792-437a-b3cf-7aeb7df4145e", "value": "T1720126121ED15AB22F28BEEBE70E2908E0DF51BD5E07090C47FDA460D81D9496433B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504877, "uuid": "54c9c91a-435b-4abd-9922-5d2c55355b2a", "value": "24:P8wk8GvKIOv788w8WIoJW4dKoVqA/j4R/0Uex:kwfGl8jpGU9i4Ctx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645504877, "uuid": "a1c72c57-e86e-446c-95ec-701378220669", "value": 812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645504877, "uuid": "44c037c7-4863-4f04-a2ad-1ac741c78539", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504877, "uuid": "dbf769ac-5fd5-4109-a879-239dfc4e1aee", "value": "abc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6ab16c-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645531668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531668, "uuid": "d2ff3895-5527-45e3-9633-a4bdd40b795e", "comment": "Malware payload (AgentTesla)", "value": "0723cb7a61bf15931b52e3b650a6da49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531668, "uuid": "1b5c1d70-8a1f-4dff-b47a-878e84df3b61", "comment": "Malware payload (AgentTesla)", "value": "8c76effeb1794311373cbd5168fd491580d7cbb2d0fc400edda4ac12a384672a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531668, "uuid": "11a87697-0d08-4005-9a42-fdd90af0d775", "comment": "Malware payload (AgentTesla)", "value": "a17ae92d554b6dfd7623f50341df534175490c32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531668, "uuid": "344098dd-b002-4843-af5a-fc1fbb798190", "comment": "Malware payload (AgentTesla)", "value": "6ad88e283ae3d40d2cb8ea0ca4db9302e1f9b94aa56cf6dc7bc24f731ef2568367a25c3d1a92cfe5002a4c5811953bc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531668, "uuid": "952d1e31-535f-470c-9b91-c9f69183c3af", "value": "T10183D027E7CA4672EAB44775B587893263E80F12B01BA0AF34993ECB74A27554D4FB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531668, "uuid": "53e37bb1-bef4-4498-a15f-83f4815e1b37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531668, "uuid": "7a3d4b72-779c-46a3-8aee-4b3ea1a4ae26", "value": "1536:BjnQTJiT9cPppv3s54ldQxM/TsLi+vQrpazPcXofYsxzR17TtJeqZZ:tmF68d4kX6YsxzRB5JeqZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531668, "uuid": "49ebc48e-cc55-46c8-9e02-95af9376a2fa", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531668, "uuid": "dbb3f5fa-fecb-47ae-b8ea-fc20a07dadcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531668, "uuid": "c9fb4bf0-4f09-40bf-8d63-48f9f54dc226", "value": "no.PO2222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b7dbb6-93ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518769, "uuid": "01b7f3eb-3ed5-4214-9e50-31d661f356ba", "comment": "Malware payload", "value": "ec3a003082a19fd6a00f84df315d18a2", "object_relation": "md5", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518769, "uuid": "70c3b394-09ca-4c1f-8475-2755cbfdd83c", "comment": "Malware payload", "value": "8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143", "object_relation": "sha256", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518769, "uuid": "77097f34-4f79-4e76-99c0-c28e1275be3c", "comment": "Malware payload", "value": "e7268a6982c3d17aaf472b331b67fbdbc4000dec", "object_relation": "sha1", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518769, "uuid": "bbea4d34-770b-4388-872b-6df5310c0e38", "comment": "Malware payload", "value": "af4b92222c1e9bceed66e16ce7dc50ff12ea1815eb9f53d377416d51be068e1630c7094e9ae176109bb3c74ddcb585f9", "object_relation": "sha3-384", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518769, "uuid": "c2c98bb8-5771-40fc-9846-3ebd44a8417e", "value": "T11A44020677C561BFCB4201302FAF3B4AE2B9A53964BDA609FF94065E7A70543421BE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518769, "uuid": "185c238b-df82-4c86-8417-7308adc986c6", "value": "3c98c11017e670673be70ad841ea9c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518769, "uuid": "4fd12e5d-cb16-46f6-992b-1241f64feae8", "value": "6144:yz+92mhAMJ/cPl3ieBLVcFtRbUN5T+ZjOEGdjP/Z17jsjnvlmVr:yK2mhAMJ/cPlfcFnU6kdZUnvYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518769, "uuid": "9d678d1e-325c-4d83-9d19-87d6a21dec49", "value": 273638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518769, "uuid": "7f660b3e-c009-467a-ae71-723acc2d380f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518769, "uuid": "2e381438-f382-4b93-b51f-3d1e94833ba0", "value": "8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5346d801-93da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645532645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532645, "uuid": "e0ced479-7748-406c-bcd4-1e124e38c7b0", "comment": "Malware payload", "value": "e80d4b0455e238285155e473a0321eaa", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532645, "uuid": "156972eb-3a41-4c37-935c-3b28c74ae4da", "comment": "Malware payload", "value": "8e4d78f2b77269eb804f3d86f9e2faf495e38f33d466bbae6ed8c016178d9443", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532645, "uuid": "e10c111a-70a1-417f-a35c-9560031abee4", "comment": "Malware payload", "value": "910d18e1883d9c86cc386c8222c3e464db31429e", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532645, "uuid": "8fbe4c15-255a-40be-b921-d3169654b3f3", "comment": "Malware payload", "value": "88ca00e93a6dbfa5816adba8bb608d73a7a1f6d9d809b037c13d42d5f3b630271d3b2b640180f31528021d9bad067c74", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532645, "uuid": "e124a3ed-adf1-4444-aa65-44bcef7df683", "value": "T1BE81FB99174FCAFCA223AC8495C95A47EB768636062CE6C4DF60BFF6241146CD4F0898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532645, "uuid": "2623c500-7f2d-4af4-bb91-a779330acf90", "value": "96:a49U/i5JAbUa7TVTxeJqSnF3JM4dmDBRkALt0CvzAuZYFiiGiXo:RU/zbnnSJlnF3JM4dmDBRdL3CFmiXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532645, "uuid": "171508b4-e55d-4e17-b8e5-aff799f51ae2", "value": 4009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532645, "uuid": "5f256262-58f2-4018-98bd-f846a5748e79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532645, "uuid": "39a23b6a-6b00-4034-9630-115b24202db7", "value": "documentaz_509.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92943902-937c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645492378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492378, "uuid": "b10a3715-85f1-4d86-babd-844443aa426b", "comment": "Malware payload (AgentTesla)", "value": "4292aae130cb1790098225cd157e01ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492378, "uuid": "ae6d2784-ff2a-4654-8705-65ce29d8b0a2", "comment": "Malware payload (AgentTesla)", "value": "8e860697ffb4844dd2899d9b92e1c82a768d9c0853a7e6f0bc0dccce54fa91e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492378, "uuid": "82d6478c-549f-435b-b170-70e51c378d85", "comment": "Malware payload (AgentTesla)", "value": "ef03cc4b38ac7f565e092ad7018219ef02d30861", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492378, "uuid": "e6d97ec6-fc2c-4093-aa9d-73d3c2893ff7", "comment": "Malware payload (AgentTesla)", "value": "2a96219fb0bd8d63fc22a50e6a910dd590c85b23406030aabaac1da39f9729c2cacc4dfb45235e5ad70dd982dad2accf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492378, "uuid": "a2a8d27a-302b-476c-8686-6ef35efbe657", "value": "T19423D02CC5412607C5B3583DD4B894E216669C177115098FD2FEFE8F0AA8E9B274FBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492378, "uuid": "64925259-cb77-4bad-842d-f9c50fedbb1e", "value": "768:W+HRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTt:W+xJqHt7NJECQFfqAZ3EcWBqvU1/K8Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492378, "uuid": "2d431c9c-989e-42fe-a57e-6d4ebf47026f", "value": 48007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492378, "uuid": "e03b731b-a7b9-44d7-8116-fff1d5b769a6", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492378, "uuid": "b0e29c9f-00ef-46dd-8b88-065839f106ca", "value": "IRQ2107797.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062f5be2-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645538958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538958, "uuid": "2bdf9bc0-7f31-403e-8964-6068cacc8417", "comment": "Malware payload (Formbook)", "value": "1e14636c18cfcb7959f05816ba86503c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538958, "uuid": "bfb9c4cd-6531-4ccb-ab45-79c47aa9a40d", "comment": "Malware payload (Formbook)", "value": "8ef4a2f7e0e66b8b84b3b8a18ad3dee9d559717f27ea2362a361405bdf68c9b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538958, "uuid": "71fbb2d9-8cb8-4a30-b025-087caa5be59a", "comment": "Malware payload (Formbook)", "value": "60ce1ce6b11cd9391457e3f99b9cf49adf40ace0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538958, "uuid": "f209085b-288c-4d5c-8a66-f5a5f6d2cdc7", "comment": "Malware payload (Formbook)", "value": "e2f423aa3aa4e3b20849f4f3f04a24bfcbeac56ad91df00d4075575cdfc013f5386ee2a275683db9a6287acec329dfbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538958, "uuid": "589612a8-fb1a-426a-a8ad-e803bab4f1d9", "value": "T1074549D83740B1EEC857C936C9785C61EA21746E8B0F8207A4532AAEAD1D79BCF154F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538958, "uuid": "b117967a-7cc0-4fe9-b20a-df4e56ccf0c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538958, "uuid": "ea9288fa-ed04-4464-9772-0b01caa43be5", "value": "12288:VDCGeWcJDZrCPdNlg+WAHcbUeOedx+IEP7DhCnx7V3FGXgRvpdVamKyGfcznwxWk:VD+yTg2qUBedQIatCBV3FIiAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645538958, "uuid": "89c0a876-208c-4b6d-9219-d69dce9015ab", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645538958, "uuid": "66a33da8-fab8-453a-ba83-6c78ae3107a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538958, "uuid": "af5687da-4d56-4bf6-8b2a-f83de3b28d59", "value": "Swift copy payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d039b3ea-939b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645505796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505796, "uuid": "408126ee-511c-4540-9c38-739ae3f2b2de", "comment": "Malware payload", "value": "e08349fb14150f852b47010b68cbe30c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505796, "uuid": "d2fabecc-16f3-45a4-883d-4c3a41ad026e", "comment": "Malware payload", "value": "8f8f2f7069af54f2b453a91a582e45a80a1852f7ab507c550f0c9e62970c1692", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505796, "uuid": "c2be2026-f346-4c21-bf2a-f251010b5fcd", "comment": "Malware payload", "value": "ae29889a526b036a6349bd383817219f73cd90c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505796, "uuid": "83f0f499-2381-43a3-9ebb-4136bfaf1cdc", "comment": "Malware payload", "value": "ad0b0e37a00ba5bf22027db0507c9833cb960f944b68db569f07f925ee6c7528e64b70c79293111e769d6896c796758f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505796, "uuid": "1030dbb1-82be-486b-bb48-ca5c3709fbd6", "value": "T1AD830206BF25DE0ADF100C7327ED8F9D8D78AA5F4AABB0B569D1848F27901CA7857305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505796, "uuid": "cdc6a94d-59f4-460e-930b-04a354bfe491", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0CQFW3RLlH:phNlHuBafLeBtfCzpta8xlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505796, "uuid": "604fc786-92c5-453f-ab86-6620f071525b", "value": 85436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505796, "uuid": "b47b8cef-9ab4-47d3-8ac3-7490e59ad038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505796, "uuid": "993c29a2-5da5-476c-ae21-8fa4c82beacd", "value": "SecuriteInfo.com.Linux.Siggen.4218.21265.6750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66bb65d-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518289, "uuid": "b40a1315-03f1-46bc-a0ea-fe5d8820f18d", "comment": "Malware payload (njrat)", "value": "5b13034d563ddde30a807890ca105f37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518289, "uuid": "3a87134c-d714-4686-bee2-8afbaf6f71e5", "comment": "Malware payload (njrat)", "value": "8fa93d81a045bd570c1219cadb9548551d75a6201bb76d4fd61fa03ff6a7da6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518289, "uuid": "e282634f-f4e8-4264-8fb2-105b464b141e", "comment": "Malware payload (njrat)", "value": "4445c332c93f1927d55ec4d49aaa59c289dd5d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518289, "uuid": "a87b0a49-6a39-4189-8f49-bb31d8f9df8e", "comment": "Malware payload (njrat)", "value": "662ffd6f5201e0dd42746a8e6ba37f6adac24712f15707004620f07672424f8680372981694b5ede1a9d71d9958b3898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518289, "uuid": "dd35d853-9aa8-4a11-8ad1-12ff03f82a8c", "value": "T1BF13D88DB794D174D5FF8BF1B492B2890B71A01BA802930F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518289, "uuid": "e440697e-8042-451c-afb0-653e703be044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518289, "uuid": "288ebba1-efe3-4e85-ac9e-844e7e083b0d", "value": "384:TZyPINU1SoycwJORpvWhYY4GMiELvho8Gzz0Iij+ZsNO3PlpJKkkjh/TzF7pWntV:d/qglcwJkxXlZoHuXQ/oo/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518289, "uuid": "65d0f796-736b-4ec2-89e7-e179e99cf1d3", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518289, "uuid": "9760dfb5-d8c3-49f0-8a99-2990d47f9313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518289, "uuid": "00f4ab1b-646b-4afc-9d1b-49e23e6c24b6", "value": "5b13034d563ddde30a807890ca105f37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84303138-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "8d2977d0-c501-4c46-b794-fccccd85e19c", "comment": "Malware payload (Heodo)", "value": "c837a6f74586fa29e7627c25d478caf4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "3b3c56e9-527a-4468-9d7e-16544c02cea2", "comment": "Malware payload (Heodo)", "value": "8fe326b5b2f3b45e3341a77a33897b61082608893f3a92a0b66caf7f1d8ebad4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "0c5ced9d-4223-4eaa-9aba-ce804e641d28", "comment": "Malware payload (Heodo)", "value": "46078c4d45cb40928ce8ac9f603e188d8c24bd52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "a6f1c3e8-20fa-4099-ba17-edf95b5da385", "comment": "Malware payload (Heodo)", "value": "4a90015f21a4dbe92967e0f82a45e28fa82f7397e19fb0797bb7c55e46dbabda6bf9b351ab1a94f4626244eb95d38d76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "a349ace8-5656-4368-9ff3-8a0e08de34c7", "value": "T1EFB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "32d1b26d-d622-47fb-9fe5-6ca6fdb072e0", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "bd73831c-d33a-4c68-9262-e1dd55449fba", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wTIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWEzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564939, "uuid": "95f44b45-fecd-4017-81d9-fb3062eed0ed", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564939, "uuid": "6f8deca6-ae87-4597-bca4-d2c8f4a21553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "b73391b4-794f-43c7-97e0-f82ebf55c0ec", "value": "emotet_exe_e5_8fe326b5b2f3b45e3341a77a33897b61082608893f3a92a0b66caf7f1d8ebad4_2022-02-22__212214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c60cd2-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490048, "uuid": "6d052e72-f753-4de6-bff8-5558c6914c64", "comment": "Malware payload (Mirai)", "value": "74c363d23102c8fba31f14c381587cb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490048, "uuid": "77696971-1d2e-47f3-86f2-03f4545cc0f6", "comment": "Malware payload (Mirai)", "value": "8ffa0ad39bb3fd2f970e4dfbda08d7c84076ba6f2d897c38f544e2f8776fcc06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490048, "uuid": "1202748f-1128-46bf-941d-3b4fb2fcdcc4", "comment": "Malware payload (Mirai)", "value": "c0eedb633a778eee3c1d7b35286b6f058073da79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490048, "uuid": "50021712-6390-4bb2-81ae-2afda5b521d6", "comment": "Malware payload (Mirai)", "value": "ebce56d2ffed103440d9f7c2f02d630c9e1d0a007e59ded74910a4063b42a7b2bcee3c885709532c17d19e6c88564451", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490048, "uuid": "2ed3458b-515f-43a8-9350-e188edeed2f3", "value": "T112534CE9E4019E7CF98BDBBA81624E0AF921321264530B27B677FDD37D310A59D12C4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490048, "uuid": "9dd137bd-038e-4da4-976c-0df9c9df3b9f", "value": "1536:9YFfWiwi/eIZUTfK79JHg1pwOCWPL10q2lC5Rh8S:9CeiVJqpwOtDqCnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490048, "uuid": "72e1be69-0098-4f60-8ea8-757f5591369f", "value": 64048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490048, "uuid": "0a75eba7-7f8c-41e3-9b9b-991ab147d180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490048, "uuid": "b9872b71-dc32-449c-b0e4-a95dec188fbe", "value": "74c363d23102c8fba31f14c381587cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc04b6fd-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550457, "uuid": "79ed3d6d-040c-4305-8bd2-d9fceba7fa99", "comment": "Malware payload (Heodo)", "value": "706770b316baf65ef96a891b1f7c9594", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550457, "uuid": "ae6b91d8-e926-4d70-b454-e2c5f0155596", "comment": "Malware payload (Heodo)", "value": "903ac8511598218b08dc4bd4f573951bdb56f8bfc36cb757f85298d7e7188327", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550457, "uuid": "d8484d18-a5f3-4d26-9b6c-04138d1d16f7", "comment": "Malware payload (Heodo)", "value": "543d2a1aa2ba8311e0dfcd8ba898dc9c55b227ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550457, "uuid": "59d92382-aad3-4ffd-adf2-33520e0c9549", "comment": "Malware payload (Heodo)", "value": "68d9f94aaebce2a468bbec27f992847812624e5db239f5af99f97d5c4f69121f25e50340a2a8f23d8f4a1b70f4f4dd31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550457, "uuid": "cf17fb3b-b4a0-4102-b58b-2a3ca91c71cc", "value": "T196A4AE21B6D0D432C26E30747A16E2B15AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550457, "uuid": "c730b1ff-2c3d-4323-a92e-37283afd75f7", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550457, "uuid": "3c6f7bfd-0322-4775-a2d7-ffacde911d9f", "value": "12288:vicw4w2Vb0zq6k5Z2mTSjqkGXNrGHORQuBT:viSwub0W6LmTmwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550457, "uuid": "1b388ebc-6811-4a84-8ffb-94207c906cec", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550457, "uuid": "d3d1f9a8-93c2-4c09-a767-6c2de7c8304c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550457, "uuid": "088e653e-9a1c-45eb-b033-069dd2f86020", "value": "up2wr3sa8IbtiyyRn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bafdd8-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550478, "uuid": "b9158103-2acd-4afa-981a-3a7a891f7477", "comment": "Malware payload (Heodo)", "value": "c711e571d9765051136d96ca1e512832", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550478, "uuid": "e930ebea-3d23-45ce-b20c-2e4f0dbd309d", "comment": "Malware payload (Heodo)", "value": "904092bbfd4b93370a11b1e9778675105d50370fc45bd06af457a1cf384e298a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550478, "uuid": "fe52654e-073d-4ec9-b8fb-cd82f2f75bcc", "comment": "Malware payload (Heodo)", "value": "40004079231d651cce8fca9b23efa593f5fc7360", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550478, "uuid": "b565b09f-8e5d-485d-a840-b76955e48d4b", "comment": "Malware payload (Heodo)", "value": "dcd84ed0b7ccec58eb686f4402abd6182d16f24d9cebd74bd2ce7e8e67a3b63621c8305f3dd3a3b7afc6e03255d9b815", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550478, "uuid": "25d4b4e8-1210-4188-8534-52e07c17474b", "value": "T181A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550478, "uuid": "b0dda0f7-ca54-4a6d-8b7b-d25985c4ed25", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550478, "uuid": "849123b2-c22d-409a-b36c-09d1bba57104", "value": "12288:vicw4w2Vb0zq6k5Z2mTljqkGXNrGHORQuBT:viSwub0W6LmTzwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550478, "uuid": "3e0597de-cf38-4e39-945e-83ac98170ace", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550478, "uuid": "0727f59d-62fd-48a3-bd60-9bde4dab686c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550478, "uuid": "323d72c9-32be-4f9d-9846-80e00e17e863", "value": "EpU6rQ0Ym2Roa1wyUBxugpR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f05a746-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531778, "uuid": "0b7d5189-08ff-4a9e-9a74-769413e6aca2", "comment": "Malware payload (Mirai)", "value": "dfc00e8865645b2a5a56d1a083d5e898", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531778, "uuid": "1acd4d42-19bb-449a-8977-73996e9e4514", "comment": "Malware payload (Mirai)", "value": "90f7cc83633fff97f0bce4e313cc4aba94acf8ec51f268b23e57de2eaece11f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531778, "uuid": "86844441-a0c9-4192-b4c3-7715370bb0fb", "comment": "Malware payload (Mirai)", "value": "5b70b62b068eae42786dee3e9dd7c240443e2b1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531778, "uuid": "d2e58e24-6708-414d-b2ea-004e5a7705ef", "comment": "Malware payload (Mirai)", "value": "d2032bd6fd6bb5b72f6e60c32dd40d82b8cfffbe68bee19dd0cf4a4851b4cb54e876a96e3abea5e88b5626b90008822d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531778, "uuid": "aadbc17a-3987-4bb4-8ea5-0efbee8be224", "value": "T15C633B4372280F47E5A24AB4253F1BE093BFED5024F4BA88694FDB5A4635E761086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531778, "uuid": "3f314d42-1f81-4b5c-b7e1-975be03247cd", "value": "768:rtbRcTIqx+TV7Rn0/qPhTS1qBeaqPfH3MZfD9NwhOm7SGa6swxH5R+h2xMBS62OU:4g7q0TS1qBp2PMQOLwx36EZIJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531778, "uuid": "d0383dee-ce05-45f1-935d-beb8bbf920c0", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531778, "uuid": "30173948-b711-424c-b642-7a60dc413bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531778, "uuid": "55575bfa-b9c4-431b-bd7b-6efa32b9800c", "value": "vcimanagement.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3669f2b-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645518740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518740, "uuid": "732620af-330f-43aa-ac30-f4c74b50f9fb", "comment": "Malware payload (AgentTesla)", "value": "540808adef133cd52174f64bb166955b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518740, "uuid": "7cba386d-3ad7-48d2-9f68-a7fe58f3da6f", "comment": "Malware payload (AgentTesla)", "value": "91007dba3f9408abfa0f5be21e1edba98f7e9905220f8df141482c361ebf0391", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518740, "uuid": "27aee363-6a03-492d-97dd-5b31358972a5", "comment": "Malware payload (AgentTesla)", "value": "44337f2e8b45435b349a56ef3013634df21ccb11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518740, "uuid": "a3e3a2f3-e440-4049-aae1-b8680b09a93c", "comment": "Malware payload (AgentTesla)", "value": "33d25eeeaec2fe68886c1595d5cb83de6dd0bb4067ffe9f2cf66256e64aeca52e1398b4fe4352467ca10c33ef1841faa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518740, "uuid": "72096a28-8d93-433d-adb1-814cb1aa2747", "value": "T1ACF46BAC02007EABC5FF11B473145D01A2FECA737216DB8D3DE169E6D6C2A468727798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518740, "uuid": "fce9c22f-3f55-43d6-a401-4cf6dfc6fed1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518740, "uuid": "8a26f859-70dc-484c-ba4a-9d683775c131", "value": "12288:t5KZnuV6he3fNilCUOgAcsjIagUwKQANnTsrTljsdCDBSbgq7ynY5y+MjakSsq:A5QvNiNOOsjIaGUslnPqWYA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518740, "uuid": "bf91fa39-93c4-43c8-a653-3af405d339c1", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518740, "uuid": "cdf8f1e5-de1f-46df-8413-7e9392154164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518740, "uuid": "d3108d9d-b6f7-42e2-a093-5b564548037c", "value": "PO_Contract_ANR07152112_20210715181907__142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8d365b-9395-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503048, "uuid": "35f50488-4683-4fc6-995f-97764a3b5e53", "comment": "Malware payload (Mirai)", "value": "437dbb80f0e181f709ff7d51669d1297", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503048, "uuid": "96094d5a-2a9f-44fe-ad03-7a37152fc656", "comment": "Malware payload (Mirai)", "value": "9207f35f643ba61ee2f4b76c44e6b9c5558fc2bd47d35b5a1d265a66c6ca80f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503048, "uuid": "30e01337-72b6-464e-aafc-d2af96a02f5d", "comment": "Malware payload (Mirai)", "value": "37076e447c4106dae82cc2fdf74b5de17e332b92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503048, "uuid": "1c966d00-bc8b-41f3-b50b-cc1574918d41", "comment": "Malware payload (Mirai)", "value": "e249cefd617e2a3b550d9b7f74dfd26228df1ae172bd1cecbfd7e3e3bb6a4044c08aad775ba98ef58fb200a5cef37257", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503048, "uuid": "0f1efd38-a9e4-479e-9551-19f6d7cd5da2", "value": "T1DAA32A47B8A25B52D6C526F6FE0F110A73078BA8F2FE3213DC245BA0778B85F0D66945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503048, "uuid": "42df3888-f3c9-4849-a400-e57cc6fe8b5f", "value": "1536:cFno/gKGKmcHdo/YNsCYIaue9aqo/U73wTb1L0d0iADrLmah0RC5TqZ:JmEE89gue9aqMOc5Drqah0MZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503048, "uuid": "388f9f9c-c352-4baf-b1d7-57bab5c50b09", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503048, "uuid": "dd8a5a61-e3a3-4a36-87a9-7d2c602e939b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503048, "uuid": "e71f8ac7-697b-4bab-9546-a212882ed5f7", "value": "437dbb80f0e181f709ff7d51669d1297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7a02bc-93bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645521117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521117, "uuid": "9196d42f-ec49-4f6d-8333-644549be71ea", "comment": "Malware payload", "value": "dc87a662cb9b933c5f9d356f6b42833e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521117, "uuid": "84bbd37d-9010-435c-a4ec-ae9cf2638750", "comment": "Malware payload", "value": "9228e6cf5457279cb21a2e717d297ddede94ffa780cff2ccbc4dfe50c3f6c51d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521117, "uuid": "00acafdf-7f80-43fe-bb88-5e6d1ed4fd8e", "comment": "Malware payload", "value": "761a5d2e97d96a6635528509f15d0b983e39cfae", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521117, "uuid": "14230ba0-6090-4249-8b31-34860e2c2420", "comment": "Malware payload", "value": "245a2b0a31b3c07379f222e336982bd8422e16f4c3512ead74e17d425a84a16a4f0e55b8cd689aad9fbfe97c3939a1f3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521117, "uuid": "dfa121f9-2c56-4025-bf6a-b488895368e6", "value": "T1ACB60147E318A95AC4F283334EBA2A71154A4CA59F8397D33918F77C18B7AF44B45BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521117, "uuid": "11f73a81-8972-466b-b277-ab6cdd50f573", "value": "196608:vQRxjt2VCvLngmcKRpXlHkKKjolMEVkBHL9MbPofC4hltgAIoAyfwro4/4V9YJJ7:vIxjt2VCvLgFK3lHkhEK4urSEfC4hQ7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645521117, "uuid": "6315abf2-109f-4fa0-9735-668138c3ea0f", "value": 11208844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645521117, "uuid": "83e01056-e57e-49f7-ae28-d6d97a2e335f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521117, "uuid": "dcbd5052-a466-4fba-b5ed-34b3e5e5b306", "value": "Simple QR Scanner.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663c9ee4-93da-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645532676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532676, "uuid": "ab85ffdd-9c95-46dc-a33e-e96a15c3ec52", "comment": "Malware payload (Formbook)", "value": "d68d72dbbc80bbe3cb61c71be0146049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532676, "uuid": "d57b00a8-1983-4f8f-919d-0f3236852e40", "comment": "Malware payload (Formbook)", "value": "92b706535d37d4fd19649fcc6211da34073b0f8ec05c22b7c0f6c0c88e4de094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532676, "uuid": "091adcfd-181f-4067-be2c-4613eb71c70a", "comment": "Malware payload (Formbook)", "value": "1a81bccc41985f64fbb89ea9973e0d1e4d915278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532676, "uuid": "bcda8a01-1253-4949-85a6-60a547cabc1d", "comment": "Malware payload (Formbook)", "value": "7b8609d562f6f56d99d59bbf03db1b36fc63dbbb01f0a2b66bde250b937a0bed696ac0f30d5aee17809da97f17dcc198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532676, "uuid": "c011e74b-0ad2-4525-94c2-e015ef0bcd5b", "value": "T19D34232319D454B3F12712710DB7ABB9D3FDA30814834AAF27E99F6E6D2714B401DA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532676, "uuid": "f714459b-da56-4287-b312-a3e4d1ef2515", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532676, "uuid": "62255dd2-78d5-4b30-9070-926f86c8ae44", "value": "6144:TxD/Z5OEFBVZsycdf1mhfp1oCI2UTgPfXjhd:AEFBVZbcdIQTgThd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532676, "uuid": "777400a0-ad98-4715-8987-5ea9c97b86c2", "value": 244182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532676, "uuid": "af5ebed0-d239-45bd-a2a0-d6545eb85165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532676, "uuid": "570c440b-6eca-4b87-a30b-2c2e2dee5d6f", "value": "BN888906SL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3998f185-939a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645505114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505114, "uuid": "a75ef4d1-b085-41d6-92f0-6b95da3548cf", "comment": "Malware payload (Formbook)", "value": "707fb4aebca4c78e0246791cc84b6ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505114, "uuid": "2d1e9f61-3829-4dc9-9fd5-810f9305453a", "comment": "Malware payload (Formbook)", "value": "92e4964a6f237d0ac0e881fbdb1ed93a46e78cead4894fbd9667a00a80b96da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505114, "uuid": "3f59b247-2e2d-401f-b780-aa39bff7eefc", "comment": "Malware payload (Formbook)", "value": "8e4c2e3729123d93d69fcd64364206fb9e23bb71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505114, "uuid": "7be6014d-cbb7-4854-bae1-901f4606d22c", "comment": "Malware payload (Formbook)", "value": "0baa71c1b3417b6632e003e21a43f26194ab43d20a6b2da6225236cfea1c893d3c60a88fe5f907972986476d80457e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505114, "uuid": "ca182991-33f3-4d02-bff4-9ef3a2b852d8", "value": "T1A6E2082162BC02F0FADCCDB06E15D37906659C418472862AE4CB3DCAF937A13CB669F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505114, "uuid": "428d5b42-9947-43da-89a9-716ac203ac45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505114, "uuid": "01694673-03df-42c3-bd56-a020ae647e60", "value": "384:5JdEFzVbKC+wnDYaXXl7DsIzll0zJJnGzMgKKsMVqJfbw79:5Jcb1HXmIzll0zJJnGzMgZqJDw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505114, "uuid": "46431b96-57b8-46d4-92fc-6f4d7dd06da7", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505114, "uuid": "ba3d0f94-5f66-4cf3-83d8-92772400b774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505114, "uuid": "a44a6e5a-828b-4fe4-87c3-cb3a9b44701c", "value": "BL-60126030078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24fd965-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528160, "uuid": "1379073f-57a5-41a5-8431-fd9c2b00a87d", "comment": "Malware payload (Mirai)", "value": "359a28f0a27479158094aedaf6a50bb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528160, "uuid": "4a6fc0b7-f7bc-46ea-b763-499e6bbf6966", "comment": "Malware payload (Mirai)", "value": "934ec6283677536123c701710ec2359dda1f741ec6566958731e9cd49ed60b9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528160, "uuid": "879f76c2-3d89-455a-b001-4405afb003d0", "comment": "Malware payload (Mirai)", "value": "6440ab7c1b7482ed051c0f734c9a78543078f34d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528160, "uuid": "62b62aaa-a011-4787-82da-190943dc1a0f", "comment": "Malware payload (Mirai)", "value": "06afa3c22852b09263d644355d626f01f90510c8811e79f76734c099d071c11bb46660d24cf65b8ae1db1f00152c7361", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528160, "uuid": "97f47e55-b52e-4285-ae44-437527e8a4c5", "value": "T110338EB3C42E7D94F14AC278B9204B385B23D40696833EF5A68AC6974047EDCF6593F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528160, "uuid": "17aa7f12-9725-4fe2-940c-6a55b1d93373", "value": "768:z3/zTfpYtWja5FLMJaEwtAObkt7qRDo9LFAnpC6FLyet74umCxYoyTECQLpE:z3/vpY6OMaEwtAdOo/Ap3NyQmCYECQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528160, "uuid": "32542263-45c6-412c-9431-4834f2450bc5", "value": 54688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528160, "uuid": "94005d4b-2609-4592-84df-3fbf0e7d430b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528160, "uuid": "a559b329-2d3d-4518-b350-63a566d354d6", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf13b2a-93ee-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645541464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541464, "uuid": "837ad0a5-b0ae-42f8-b555-87a799d769ef", "comment": "Malware payload (DCRat)", "value": "bd2faaa3e1211c9a88db69a5265b03e1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541464, "uuid": "46dc369c-7fea-4a50-8409-c9c95fc867c8", "comment": "Malware payload (DCRat)", "value": "93c049876b916ec5034d9884338be59b11bce8a74f4d0bea329a3ed028c41b88", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541464, "uuid": "3a33c723-dcf1-487a-a6f0-18ed43283f85", "comment": "Malware payload (DCRat)", "value": "849b918144f5fda0226921a2b5bbaa0176662111", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541464, "uuid": "2bcbf390-1410-4dbe-b86f-f5a620396571", "comment": "Malware payload (DCRat)", "value": "65def20bf415b3e0413f7c00f791ea1b93387c61561ba49a9335cbf46bface206c969c8f5903ce011dd9091e64b445b4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541464, "uuid": "b5c57a6c-3607-4444-80b8-66448642aa9b", "value": "T10744AF2036C1C033D5A60E7088D5D7B1667BFEB15A21A28BFB94BF6D1E313F19621B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541464, "uuid": "192009cb-6d40-4e4b-9988-457a51c7da22", "value": "f2d8535b6642d3499f1cbaf5d6399788", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541464, "uuid": "47ce72b7-15a1-4f66-8ef8-d02a28876017", "value": "3072:ANQKSl7O5NZmUF/fE7ljYY2dbSEDT2jsxkgaBChjCKrxGchkc:AvoO7ZmUSRkJcIigad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645541464, "uuid": "dff1026f-a028-4127-a55e-d0aa736c3693", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645541464, "uuid": "1986e221-f9bf-4231-9673-49a6d2105d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541464, "uuid": "fd91bbd0-45ca-48a2-9ae3-d0a9835fcaeb", "value": "bd2faaa3e1211c9a88db69a5265b03e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1fc0ab-9393-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645502169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502169, "uuid": "95872d75-4061-4a9c-8434-63475f9b717b", "comment": "Malware payload (AgentTesla)", "value": "1a7260fe935124a6a80ffd4e4965934b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502169, "uuid": "f0e37814-5f70-4a4b-b943-4d8ed3a14ea8", "comment": "Malware payload (AgentTesla)", "value": "93d46e7124e324502a3e1a8eb8bc7a4ed44f1512d01ed8b0e05d9f8b1b481cd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502169, "uuid": "1e3221a3-7db3-454e-9849-75e5ae38f95f", "comment": "Malware payload (AgentTesla)", "value": "114072cb37611a3e3bfa27e1a8ff352323c212ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502169, "uuid": "b598bc4a-a7d9-40cc-9a43-17140f268194", "comment": "Malware payload (AgentTesla)", "value": "0e002dfd256657602152944a2bea5e3754af39170a24704335b9f3a79aee8e4adcbdc7f85d16722ba8403268b053cb43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502169, "uuid": "ebe687c1-8509-4340-bbe5-c310ecf89da8", "value": "T11AD3E74CBD938662C7B5123C4656D6E4392F1F9BE6E3064D326C722F1B76249283632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502169, "uuid": "8d72cfd0-db28-45dd-9b49-caf1198d9a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502169, "uuid": "c66c7e0c-aec9-41b9-a9f3-79d35c5c582c", "value": "3072:poCGsiKbWLG/VEq590TnnnnnnnnBnnnnnnnnnyvTiBF:+RsJbWaNR5ywTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645502169, "uuid": "c0e092d5-f509-4564-a33c-df6ed30818ac", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645502169, "uuid": "2c2cfe4f-5a15-4d6e-bc0b-6d933ac3ea9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502169, "uuid": "47d1f7a8-783b-4c9a-81c3-3e955e7ec605", "value": "#PO4503980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4c417d-93e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645535267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535267, "uuid": "b73b7b8d-7449-4d73-aa98-90e076fd80ae", "comment": "Malware payload (Formbook)", "value": "703540c2c3e8296b85f9860e4735d773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535267, "uuid": "d680caaa-7562-4373-a313-503052fbad4b", "comment": "Malware payload (Formbook)", "value": "95d52da676d92728d35e9fa0e6a49dc451dc83eadb8beb0ba0f2a3b891a69696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535267, "uuid": "7ccba679-00fe-473a-9db2-783ed8cd2e47", "comment": "Malware payload (Formbook)", "value": "a13a05a927377e54a006dcdf1a7b79e278eaee58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535267, "uuid": "12eb9c8b-b259-43ee-8dd5-1c292208aec5", "comment": "Malware payload (Formbook)", "value": "8c8bb11ca3de508a882c16436aace09659d4f77758a6c3438ebc655ec79f4a17923b343fdbdace2347a8335dc7ed0961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535267, "uuid": "c6aa4406-18e4-44a0-89a0-337f35a82ba6", "value": "T155B4ADB4A1A78590F00BC974257CF9A501B230E3A9C61D34676D3641DFEEFA83F85A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535267, "uuid": "73ad8d9b-f546-405e-ae3d-40d7a64eccaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535267, "uuid": "1c4f241f-8284-4b7c-947f-66e9f37ee809", "value": "6144:SBDAQVO7JpyTac3pvhAsm5fXsrGHNMNCdP1R7Shxs7eDBS3ET+yoGdaSAH3pv:SBnVO7Jy3puvsrK9v7eDzqGdaV3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645535267, "uuid": "308b3157-62a8-4e34-bde4-dcc4c7ae826a", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645535267, "uuid": "f89e1c5d-c2ed-44d8-a22c-3cd3a7cecf6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535267, "uuid": "f4798de0-73d7-494a-aca1-ba919b97d455", "value": "VESSEL DESCRIPCTION MV BERKAY N - IMO NO 9524827_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea1359c-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517094, "uuid": "8e732e44-03ec-4fb8-9f9a-2c04fcc0a258", "comment": "Malware payload", "value": "c90f6b740735ff0164ab262aa0b0c033", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517094, "uuid": "d8568365-7079-427d-902e-78aaf53247ff", "comment": "Malware payload", "value": "964cd6b18103b431fb3b0eff6d7cc811038882ffc504bcdfc963a87d1fa67a29", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517094, "uuid": "93113abb-e3b7-4655-96a3-af5de644bbd2", "comment": "Malware payload", "value": "2a0bb8012594f6d206db1ef0097522acedb098fb", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517094, "uuid": "cca5f6e6-7482-4d3d-96b9-5a910b3cc9a8", "comment": "Malware payload", "value": "ef1c5f3ff69497e2c8ffbc7f227e5ef3f4ab4cdc47659f92204356a707370bea8f85f00568e84bbfcd4e3d1e9487162d", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517094, "uuid": "a0b7645d-25d4-4804-87fc-e8acce1be204", "value": "T15C23CF18C8411616C6B3783EC078D4E15A66CC53B115498FE5EA7D8B0BA8EDB274FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517094, "uuid": "7eda9546-477b-4b6c-9d84-95a06b160686", "value": "768:O+yRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTc:O+wJqHt7NJECQFfqATpRP+86CsJ1/K8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517094, "uuid": "88055bd8-aead-4471-9497-48a4cabe8e68", "value": 47976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517094, "uuid": "c6d88b6d-1490-43d1-b176-fe67c75b3493", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517094, "uuid": "d860682d-352b-44c3-8a38-aa5d7448b4d4", "value": "6.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43b72ed-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528190, "uuid": "581d787d-e5d2-460f-a7bf-764423936a46", "comment": "Malware payload (Mirai)", "value": "ef02f2100d39dd852e2b29a238c88a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528190, "uuid": "9f665f7a-fec6-4391-b477-c80eb9179ff2", "comment": "Malware payload (Mirai)", "value": "96b422ed010172af2eaf42a8bae1fc62ef87b636f50d42397bdb410da3691357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528190, "uuid": "8499e31d-d210-4427-b592-078da0e6f8c3", "comment": "Malware payload (Mirai)", "value": "c15aa59679bf16f43563365a8f78dbc3abefc6e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528190, "uuid": "4aeb8bb1-c03c-4a4e-8c9f-70e0a824139c", "comment": "Malware payload (Mirai)", "value": "a4754b280a7a694a1e92cd4ad51c9c694ea0ec223c5c2bbc3fdbfb512b9da4cdb92957296f87ac90d1499ae106bda115", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528190, "uuid": "6df19db6-dbad-4d8f-add1-5c8eeace11d6", "value": "T18463954E6E719FBCFBAC863447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528190, "uuid": "138693ee-2636-4344-ab32-6eb3d763442b", "value": "1536:D8aCKgFqz+SIjtr3st2jpoJtFHLmvGEwK01eeW:QH+kJr3fCJtRmvGEwKkHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528190, "uuid": "6e129a11-7bce-446c-b8d4-a708d7c92662", "value": 68272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528190, "uuid": "35235015-8abf-41c4-879b-779f250461e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528190, "uuid": "716e81ae-a124-4f49-96fa-68638524d9f8", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24385e6e-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517104, "uuid": "a12b90dd-8707-4051-928b-876c0c622469", "comment": "Malware payload", "value": "066ca00b37983fe02deef72451433172", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517104, "uuid": "037f42a1-dca0-42b6-9dd4-5004a95a8ee3", "comment": "Malware payload", "value": "971d843b0e650cfe37ef92d45e6553e6642c124f6a1d9e370bd2b498705b2700", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517104, "uuid": "c65a4bb2-e69e-4b4e-a176-b643508e6af1", "comment": "Malware payload", "value": "5995f36a7b4a952c49c6f8e48b290550af90b537", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517104, "uuid": "a6b8258e-c2f4-4b4b-8709-20b6f0addba0", "comment": "Malware payload", "value": "66b50dbb68983772d0be5fa1214ed8a7d4e284936f01a80ac7bc751e6be18471b6ac0217dde30cbd0c282df77f6d380f", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517104, "uuid": "518852d7-a56b-467d-aba0-6fe62ec17ad7", "value": "T10923C018C5421616C1B3693DD4B498E019678C07F22589CFE1EA7D8F1B98F9A274FFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517104, "uuid": "7d120af7-e1ab-4f1e-a4b8-db29b07d12d1", "value": "768:PRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTClI:JJqHt7NJECQFfqAu6ky8Mo31/K8NytsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517104, "uuid": "83b531e2-bb03-4516-9f3d-86ad453abd52", "value": 47951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517104, "uuid": "6a6aa3ea-a529-458d-9739-76316d6199d2", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517104, "uuid": "15b08926-b294-4e42-8bbb-a5071c3bba83", "value": "PO A56839047.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ded02e7-93c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645522247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522247, "uuid": "e54141a1-6a90-40f0-b736-8793d6690f72", "comment": "Malware payload", "value": "894439e1761208ccf58302d9e0ceb3ec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522247, "uuid": "af7a243e-8645-44c7-8eb6-279239878fb8", "comment": "Malware payload", "value": "983ffa1a7513ab6d015e1c4785bda2a2f20a47bf6091773db9341ebcdaf84e93", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522247, "uuid": "f1068d65-16e9-44cc-8bf9-2c1176744cc9", "comment": "Malware payload", "value": "35eea3add93a7b68a24f631fc7283816aaf601a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522247, "uuid": "f6be5895-1ddd-45ad-a147-6de8c8a04c8c", "comment": "Malware payload", "value": "1e7374d62194d795b3819802d55bbd92c143e714172e2cf4a05f0edf996fc58014c5d808015c8d0f216c31b78a6af51f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522247, "uuid": "7887e2c9-0143-4483-bab6-ae6562c7c5aa", "value": "T154C47E57F7DBF6B0E6FE827A86F1851C52B774620260A78F664072886D22392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522247, "uuid": "1d3b61f6-28ae-458a-b7fc-1b10908c0007", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522247, "uuid": "1f082753-e04f-4c40-b851-602f32ac33e0", "value": "12288:Un/zDvGHAykH8vLW/4+8bzbBSreMdDBY4ZyrE7K3yl8PeVooA/AB2LEJZ3AQPUqj:2zbGHAzHKjX1YBY4ZyrE7K3yl8PeVoox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645522247, "uuid": "2bb1bed9-3c9a-4d7e-a200-f43fc02732c2", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645522247, "uuid": "9dd50532-8770-4e7d-93aa-c372afa7e3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522247, "uuid": "cfaa1165-1cab-4a43-8ef8-943530874f92", "value": "MOU_99202002FEB.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7817b1d9-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518533, "uuid": "4f06482d-5ae4-4994-a98b-decc83c8db6d", "comment": "Malware payload", "value": "ffa5f4b6b580d53bc311d6e5bace3110", "object_relation": "md5", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518533, "uuid": "9c55d1ef-de2c-46c4-93c0-82fa455b6f53", "comment": "Malware payload", "value": "9857e40be1fb5b9b6db93dc03f96f6b3ff0ffab85af7944dddcac0e37775ab02", "object_relation": "sha256", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518533, "uuid": "02dde294-c076-45f1-847f-2cc11080170d", "comment": "Malware payload", "value": "d599ca575b995d8de971aed8a64762225bde386d", "object_relation": "sha1", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518533, "uuid": "2623207c-322e-4f20-a87b-5ef394225634", "comment": "Malware payload", "value": "a25078eb4cc1e2f587bee90ea8f6b96e21d78b4600db7c3f9ffe23c22669dc81b4ef408f70015f8789e43362e8f34e5d", "object_relation": "sha3-384", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518533, "uuid": "8d5bb530-4f05-42ca-b55d-908d9a35ca22", "value": "T12D136B507060C0B3D24A527D185A9B519E6F69111BF5E4833FFB078EAFB22E4A63F346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518533, "uuid": "9f386dd2-7cc4-447c-aab1-75ff68b0d262", "value": "a0d60cd1c7847a79d4bccecffa442d30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518533, "uuid": "529704dd-9d79-463f-b228-fe0311553b5a", "value": "384:k75KY5pp3D09zQOlfMgLJQJtsKW19L6LY+CiZxvnWizzrwReFB3WK3FTUax9RUKX:+z5pVD0nXLEL3Wi6K3BUaxdJizoQIVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518533, "uuid": "3a38658d-70ad-4b41-bcad-79ffd1025c00", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518533, "uuid": "158952f4-4b7d-404b-a55c-4416c7578e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518533, "uuid": "f705df88-456c-41ba-aed4-d6db47166797", "value": "9857e40be1fb5b9b6db93dc03f96f6b3ff0ffab85af7944dddcac0e37775ab02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db158130-93ad-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645513545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513545, "uuid": "0aade239-fb91-4a3b-b80c-87653debab0f", "comment": "Malware payload (AgentTesla)", "value": "6b657f340b2d49fcbb9e02aa250d6f99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513545, "uuid": "0cd57086-f9d5-4c86-874d-8dff29962575", "comment": "Malware payload (AgentTesla)", "value": "988b6c64b66b79491a00261702d790cc9c0eb2dd4dcb414729df772ad88bd3a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513545, "uuid": "408a3cd5-9512-4ead-b76c-e0e9e38ba78c", "comment": "Malware payload (AgentTesla)", "value": "b6c7e077bbd8cf0d53debe3629893f443047041c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513545, "uuid": "68210c1d-716c-40bd-b770-4c40f8c1b723", "comment": "Malware payload (AgentTesla)", "value": "b7918e703562675801d0b779436bc97cbb3324084068bcde44919facd88e7bc9437faa1165d1f93ccf3df46d65dfbc61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513545, "uuid": "3055939c-3394-42a8-9842-09b1d1ff8ad8", "value": "T123F42325A441A3F7165C65711B3122E45C2A702F84DEEDEFECA10D0F977382B7C94EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513545, "uuid": "02fd31ed-d259-4193-8928-55ebb40de77a", "value": "12288:kyI/6KCY02UJpFJtD82MYxo0x6LCfRCjc2OE/JAMyZPXt2PP/hGVLzyHP:kqKU5DDdMYxxPfRq/ZaXmP5GV/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513545, "uuid": "40864287-5f64-49ec-bd6c-edcc358ed255", "value": 757998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513545, "uuid": "379601b6-4770-4996-bb58-596d38ff09c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513545, "uuid": "eb9c7644-5fd6-4103-b01d-f0e673839fe0", "value": "overdue invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d5801f-9406-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645551520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551520, "uuid": "e3d39b76-738e-4d5a-8981-dcc379b1a839", "comment": "Malware payload", "value": "18d42153637149a06848b5ed46981e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551520, "uuid": "744580bf-0178-4f22-8163-b8ad809ebdaa", "comment": "Malware payload", "value": "98c9e56cba271bf7b32fc17d7966d067d9b549594f8dc60c941f93346e376c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551520, "uuid": "19d23ff1-6003-46ec-8873-bdf972d34451", "comment": "Malware payload", "value": "d98eb8159ae9b82fb2e10b1172cd0ba28a239acc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551520, "uuid": "ec59055c-b13b-465f-8dc0-71ebb1616427", "comment": "Malware payload", "value": "3beb2a17cfa0dbe1ac9f11f717d3edc72ecaddbf8e956a091628971c16000a6802077631070866f6d30b62c96f5a972a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551520, "uuid": "d5f44526-cdbb-4c3b-a806-cc9d6f28a05c", "value": "T1E67402985157BCD4E9AC5A3496FEE5F89B7409B73238FB07CB8AE179342107609C0A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551520, "uuid": "ad89e812-2fc4-480d-a90b-8832ac65a6f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551520, "uuid": "a784a72c-0ec3-46db-b143-0648b28d8b94", "value": "6144:Cy6EFVP/UnTqSjgYgTERaj7xuoxxDseXQ1Iq2uN1A3JdCBeQnqNlLj7EPC5frryh:/FoTqSpgFNTrjAGq2amJGeQa7qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551520, "uuid": "0ab664e2-aeff-4425-b7dc-64844142d2dc", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551520, "uuid": "afc8d0ba-8a4d-451d-88fa-47ba1a2a5c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551520, "uuid": "7470cfbd-ea0a-49ee-99ad-40723a7519aa", "value": "98c9e56cba271bf7b32fc17d7966d067d9b549594f8dc60c941f93346e376c00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea23af8d-9414-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645557809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557809, "uuid": "582bd309-c23e-4a4e-a5c7-b0e5d25331b0", "comment": "Malware payload", "value": "f74f67f98a700f27d7a894a630e73077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557809, "uuid": "c3418321-3794-4b71-a697-f8cf6a733be5", "comment": "Malware payload", "value": "99c01d1fd62da5b29fb9b5335319ae532d30679f39096284ee2da359a411b529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557809, "uuid": "9046b455-63d7-46f8-9435-91411bd2bc0f", "comment": "Malware payload", "value": "f584f846f46cce8c6697f2cba01f5184360a34a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557809, "uuid": "02cc2438-26da-4c86-82f3-1d06d570bdcb", "comment": "Malware payload", "value": "060638de2df7b1c2e036fc03cb74b9168711ed4bceba02f9c331a2845d5104a369474088e9c0a74df14c09f01cba55cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557809, "uuid": "2646c683-738d-4763-9795-d3c8e682075e", "value": "T17AE502BDA24033D8C01AC5381533ED46F1F6262F56E4D6EABADF7AC0376E511D942B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557809, "uuid": "a2baa931-bf94-403e-a5c6-406434d6d48c", "value": "629d572bad2dcff0fc429ecaf29f92a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557809, "uuid": "94fcbff8-505a-487d-95e1-4eadd90217c6", "value": "98304:RK5C/ErkKaRBnQNtDFtdndcTDixRv5wxGVyk7:RK5C/Er4RBWh6TDeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645557809, "uuid": "c544ef5f-56cb-462a-8e9a-0029f9a3d67e", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645557809, "uuid": "6a6808ce-8f2f-444c-a931-8ea87d5c5840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557809, "uuid": "fec14e1a-af50-48ef-8c95-63f2b1f19718", "value": "SecuriteInfo.com.Trojan.DownLoader44.40553.568.24582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1486b2c9-93c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645521372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521372, "uuid": "1b6a398c-b76c-4ec3-a42f-e980cc7bf83a", "comment": "Malware payload (Loki)", "value": "946634f3d57afaa0f078796f8929a2ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521372, "uuid": "0ee9899d-6307-4afe-afb7-0007360fa1d1", "comment": "Malware payload (Loki)", "value": "9a597a7be3da23c4e2fe27e40a72a4b509fdb2959174380c673aae882e8163de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521372, "uuid": "2c4cbecc-f5db-45ff-8893-b831c2f3c49b", "comment": "Malware payload (Loki)", "value": "b8f3937d34fad855c2078148eb456cf09f95beaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645521372, "uuid": "cb0dfcb2-3228-47d4-a085-fb64cd163345", "comment": "Malware payload (Loki)", "value": "531fb6fd2d1e1c97633367393e0203f96ec6804aeab28f844eedc45549fc03430bbb2c103d53578ced20c98733095cdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521372, "uuid": "aa3bb271-287f-4c9a-99eb-fab26106fc99", "value": "T1D8F4BE042AA74F3CF1BA4BB249D1EC75F7A9E7232C09F37D78506586C652B408D826B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521372, "uuid": "6856d885-604c-4161-9ff9-829d5ca8056d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521372, "uuid": "fe3dc623-17e9-4bcc-9562-e62eb258f8ae", "value": "12288:fgB6PhGNoh7jiovhwNlXRpxyhDvKRStGAp095unotJ6WUh2NHc/Zr91pd/:jhGNJbNFRpxyhDomGtgs1NHil/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645521372, "uuid": "8fffeaad-9d90-43cb-aceb-b5d318272d5a", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645521372, "uuid": "07fe5c73-8171-4e02-8ed0-4afc6fcb0073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645521372, "uuid": "377a1b9d-4fb4-463e-a9f1-557bf4b716a2", "value": "wininit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfbc3ed-941d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645561409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561409, "uuid": "875dda68-865f-4937-9d2d-01bace63ddad", "comment": "Malware payload", "value": "3ffda6a0764b9eaed24fd9c61d2b24ff", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561409, "uuid": "4cae3399-1dd3-4c2f-8a30-2ef54c763dc0", "comment": "Malware payload", "value": "9a73bcec66ab0f7bd0bacf3fe038c16fe696afd484432b94511bc22a4f81b8a8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561409, "uuid": "efd38161-0389-4d00-98c5-cf65e55de20d", "comment": "Malware payload", "value": "daf79da3b0ee76b84ba35032e1b06042a303003d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561409, "uuid": "2d1fc8dd-f0ae-44a6-b5cd-2319cb4ed9eb", "comment": "Malware payload", "value": "f4262fd28e16822ac90a9555b14d6111a40ba73772260c95fc399180482b4312cf1f9058ee837b4560f8e29e8d456b9b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561409, "uuid": "ef89090f-4130-488b-90a1-d61376f6d03d", "value": "T1E6930769B681C95BCA5807344CD7CBF67227BC424E7A87473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561409, "uuid": "e1524b5f-776a-4ee8-900a-b19dea56ecc6", "value": "1536:s5555sDWZowD9gGtgNnEbzyehv7q2Pjx45uoDGTj+5xtekEvi8/dg98EsAeE9jbx:2yehv7q2Pjx45uoDGTj+5xtekEvi8/di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645561409, "uuid": "7144176b-e04a-4d53-a473-e6b9daec1e28", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645561409, "uuid": "527a74f8-31d7-4768-9a6d-679d6c0ee565", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561409, "uuid": "75ed5117-bd26-48f6-b3dd-566c4218171c", "value": "ommegaonline.org_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d156b30d-939b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645505798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505798, "uuid": "7f300331-c00d-4ddd-830f-eaeb2c0a8aa1", "comment": "Malware payload (Mirai)", "value": "0bcc45471bb89666956edf1a2e8dd352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505798, "uuid": "dc6dc9e0-41d2-4230-9c90-1c0829d010c0", "comment": "Malware payload (Mirai)", "value": "9a8241cf1bfae7ccaf01d2426c475f462ee119d227b56e71f2df7b9d9f73b4d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505798, "uuid": "44b0b5ac-e9bf-4234-b783-550966f9ba29", "comment": "Malware payload (Mirai)", "value": "6dafade6b91a438c9ab0b88ee00f66a037ffc2f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505798, "uuid": "1ded08d2-083f-4dc0-8892-a000593e9496", "comment": "Malware payload (Mirai)", "value": "c6db998570f967ff116dbe2de26a07f045114a06600d48410ea7eb22f62b6e8d08d4a79b58e6d010604264c6e62d52e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505798, "uuid": "96edcb56-c3e7-436b-b7ab-e13fe3e0d5a3", "value": "T188C2E13E022439EAF424CCB729ED07942AFB4F71A147980533945EF69E17179BC26DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505798, "uuid": "1df601ff-c4f3-4162-8ef0-3bdd069cb59c", "value": "768:al/2tNPTpHUgeH2LD81tclbmPAjmWYMe7JgGlzDpUYsB5:yutN75UME1tcp9jmQkVqYI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505798, "uuid": "6f41d7f1-7dcd-4a16-8612-600153b87506", "value": 27540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505798, "uuid": "127fe595-a7f9-4f58-836e-cc7ed30ae237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505798, "uuid": "6aa47342-ffc6-4090-b4b7-28485c72ee37", "value": "SecuriteInfo.com.Linux.Mirai.1288.31398.25291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d5fef7-9396-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645503492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503492, "uuid": "81bc901f-373a-475f-aa82-3f0c12724ba2", "comment": "Malware payload (Formbook)", "value": "d261ff3ddf608797f8007f534d089590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503492, "uuid": "b219d4e3-94ac-44d4-ad1e-f7e2ccd542c0", "comment": "Malware payload (Formbook)", "value": "9b4ea9f90dc0bd79331fb576e8e11bfcd1aaca5d89eed706bba28e23d81819e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503492, "uuid": "0798028e-9aee-4004-9c37-a18688a99ec3", "comment": "Malware payload (Formbook)", "value": "12d139a8cad257fe8da2cd6a0e41a702b364d1e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503492, "uuid": "813bdd0c-092f-412d-8892-b6542d5633e3", "comment": "Malware payload (Formbook)", "value": "d44997f81aff918d7b169bd8d16055916391113490eecf799c85ff1504e41db45d27767a5b7ce57f1882a81d3f944878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503492, "uuid": "8f8d457a-1154-4bf4-a28d-6ac5b873ba0c", "value": "T10605BF143AAB0F3DF0B94BB648D1EC65B7A9F7231C19F37D79402296C652B508D822B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503492, "uuid": "3dbbae6d-68e9-47bf-b66e-88d192c73719", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503492, "uuid": "d47c2958-ba9a-42c0-964c-a0e16dd6f3aa", "value": "12288:0gB6AqVNih7j8Z9mTKpZiPFavBYC0gGrrN4D35J7UkjRlKJT2ZaqLfoFRI:PqVNJ9mWDiPF0zVJ7nlKh0JLff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503492, "uuid": "c49cdb8e-66ae-41ee-9500-7a1b8baec93f", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503492, "uuid": "5d37ea2f-79fc-4ebc-8dff-22d3eef8f69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503492, "uuid": "184170e0-bf0a-419a-b895-1088ea65dcc2", "value": "jzFbN3X6HH4H0YC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a9a5d1-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645517348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517348, "uuid": "547f12fe-0f22-4edf-9b21-e7502ad13045", "comment": "Malware payload (Formbook)", "value": "5d08fe8777254cca03f80cabe22b02fb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517348, "uuid": "9225b437-fed2-4367-8f16-b623e3cec032", "comment": "Malware payload (Formbook)", "value": "9b682330445e8eb6445cc43968e21ae3ffe1b9d8c3ae5210c9a8d12416315d5d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517348, "uuid": "a2d6e7f7-11ae-4b80-bec1-07f1dee3174f", "comment": "Malware payload (Formbook)", "value": "ee01428be8acaedd7eeeb4c8c745bdb747a7cbc8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517348, "uuid": "7d188749-cf05-4c9f-bb8c-94df9b31e2e7", "comment": "Malware payload (Formbook)", "value": "f4f099bc6bd9267d69e0485c0d3e6e756e3e1e60a7c67e411c302a75c241dd07116e12108f500f84beb403023278b7a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517348, "uuid": "fc2bc070-91ba-48da-9bf2-5818fde2a40a", "value": "T1A2C47D57F7DBF6B0E6FE827A86F1851C52B774620260A78F664072886D22392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517348, "uuid": "45f65a54-00a7-4e9c-9106-12a7f3fdce86", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517348, "uuid": "6e485991-5220-48ad-9911-dee326e437b4", "value": "12288:kn/zDvGHAykH8vLW/4+8bzbBSreMd0BY4ZyrE7K3yl8PeVooA/AB2LEJZdAQPUqj:GzbGHAzHKjX1fBY4ZyrE7K3yl8PeVooj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517348, "uuid": "d81039fb-a176-473a-92b5-b0edf717dbf6", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517348, "uuid": "b7e979ec-eb46-4b53-93af-2f754deba249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517348, "uuid": "c8b6f7a7-affa-4e10-b6a3-70b897f3fb30", "value": "Request Offer.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea476f83-942d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645568546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568546, "uuid": "f595e1e0-d2a0-4483-83cc-bbabdef97d05", "comment": "Malware payload (Heodo)", "value": "f558779d592546f2f7559a04c606b15b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568546, "uuid": "549be03b-489d-47ad-9d72-45560c5f5b3f", "comment": "Malware payload (Heodo)", "value": "9bb2f5bde71936492d79985f29e9b99358c7b2b73484b24d454da43ef0e976cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568546, "uuid": "0a9e2b16-b42e-456a-9d08-4cd95e85dd67", "comment": "Malware payload (Heodo)", "value": "b23b57d056daea1a2996d363122d02735153df8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568546, "uuid": "dc420feb-da24-4554-a941-bd278cdd60da", "comment": "Malware payload (Heodo)", "value": "d76d4023c649c7d369878ba096c5de05e8f12a1f53a098a8c278df2cc114e9342b84e4f4a3d1beea7907fe27e3c79b19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568546, "uuid": "4a7acfc3-14e0-4b9e-bfd0-0e2fbb6a5abd", "value": "T1FEB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568546, "uuid": "8fe3aac7-85e6-4740-8c06-4cbc20139736", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568546, "uuid": "81d10b7b-b709-413b-8fa3-28219f5734bd", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wNIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWKzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645568546, "uuid": "d46ca556-f5f8-4f34-b1bc-bd65a0ff7cae", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645568546, "uuid": "f94ab2f3-b5f6-4763-aa81-c218bcfe685b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568546, "uuid": "9c9c6709-3120-40a9-a134-c48705d6916b", "value": "f558779d592546f2f7559a04c606b15b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f597bf6-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554945, "uuid": "ce0f0b36-9165-41e7-a867-5db81fac7125", "comment": "Malware payload", "value": "fbebede5e48d1d96d6b23f7cde2132e5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554945, "uuid": "f74902e6-1349-4eb9-a84f-c92319a9e7e6", "comment": "Malware payload", "value": "9c06fda3c8d3e681c92516e24cd43c1b050522f0630eff478d9445fa5e8f610a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554945, "uuid": "b0406894-53fb-4c4f-8aab-7b896377a29d", "comment": "Malware payload", "value": "f51113d872e4eb76f171951227d1510d0cd9d5fc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554945, "uuid": "7432fa93-c8d8-4cbc-bd72-751c9f83094e", "comment": "Malware payload", "value": "34edac631861c2be310a291795cdfab3250926cd7b58f4e92263d4f62e6590d11b490eb940139ecd0092b87e69009e25", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554945, "uuid": "0944c0b1-aa23-4549-8497-a1befa37e03c", "value": "T1E1930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554945, "uuid": "1da6d0b8-d702-47cb-8246-e090b851d53e", "value": "1536:7yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGtkWvgrPE4nWHPNc2AZ:7yehv7q2Pjx45uoDGTj+5xtekEvi8/dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554945, "uuid": "df4281c2-e1b1-4f76-a6ce-72f815f35f56", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554945, "uuid": "fe2ae5b9-afb3-4190-9a05-90574e97af0f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554945, "uuid": "0eda22af-2558-4717-80b9-cec853a3e60c", "value": "tmpwi4gscls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86635ad7-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1645518127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518127, "uuid": "c4cdee00-b235-4156-820a-692254e07bce", "comment": "Malware payload (BitRAT)", "value": "bd19b3d2c468d91914383ff043d05571", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518127, "uuid": "b8a8d637-b4f1-4783-8bef-cdbbf6b6eebc", "comment": "Malware payload (BitRAT)", "value": "9c9e4a411c6932fd52005ae0899804c9319dc464418e93fe25ce711d3fb947c7", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518127, "uuid": "23ff281d-2cf3-4923-92db-727cbbd10d7c", "comment": "Malware payload (BitRAT)", "value": "da42b5882cf905802439950b8f988d198817a56a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518127, "uuid": "ff29abe8-e492-4ee8-bdc8-d15aae20468a", "comment": "Malware payload (BitRAT)", "value": "c07d8e0fbbd5f071cc075f01b6f7a07559eff23978d423ac6dcea8dd00308ff549214d18b1e1ff8ae550897bad8993b2", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518127, "uuid": "605a90f1-6775-4aa0-95d4-3ecb699cafef", "value": "T16285CE7C256E6E4CF79494BCB1758EFF27A2BC2F00A774F7901CA1D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518127, "uuid": "f1f34455-9fd6-4ecd-9cd6-bf5d4afa8355", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518127, "uuid": "7b34169c-4f1c-4a15-9493-76fb7785d179", "value": "49152:XpEuW1sPapJLiNnscG9EONjeSpsZ5Ruhj:XpEdtLiNZG93jfpSPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518127, "uuid": "be97649c-b56d-4147-b814-f4ad8da4f087", "value": 1767784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518127, "uuid": "9e24ac40-f2b4-404e-9030-dfbbd578b39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518127, "uuid": "fe908501-1d3e-489c-8391-ae4676e7ee9b", "value": "bd19b3d2c468d91914383ff043d05571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433b182e-93fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645546362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546362, "uuid": "7d6a6338-d0c3-4913-85e5-824c97d393cb", "comment": "Malware payload (Formbook)", "value": "e08a5d1e050b54a71f6087873d79b403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546362, "uuid": "b500c3a3-8777-44ab-94ff-86f8ef25cc1f", "comment": "Malware payload (Formbook)", "value": "9ca4f52f4b1edfc807382d70fadb1639271f58008386729da8fe4ec9654a4e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546362, "uuid": "29ba7d6c-8193-4297-a411-b552f1a0b06a", "comment": "Malware payload (Formbook)", "value": "a4b76110763cba4739a7325011f4520c03c7b268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546362, "uuid": "0874208c-cd81-4744-a84a-7efe0bc974b3", "comment": "Malware payload (Formbook)", "value": "10219fa94e0d3df17e92211cfb406491dbf93acbbe18bd0cc43d3e9c94a3431aed7ab51a1ecbb1e7a9a4f1c9c4a9cf36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546362, "uuid": "29dba4f3-d09b-42d5-93d9-a2184f27658b", "value": "T17AC46B9121E6CBB5E4FC53B8F42240F60FF07D1ED216E12B3DA47E8975B2E4156A3A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546362, "uuid": "1b4739d9-76e8-4c11-b8e8-e14341b8729c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546362, "uuid": "7857ea75-6b78-44aa-9bb0-b6fcc8b26d4f", "value": "12288:CGD404Tvqv0FKI8Pa2acUNoeEX/nfUqhuBQVDLc:5Dz47qv0x/knfXax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546362, "uuid": "bfe52a11-8d26-4e33-befc-61dd02a838de", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546362, "uuid": "1cb989d3-5fbe-4be6-8c46-25b8a2daa5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546362, "uuid": "a265d482-9f9a-4f69-a8a8-6fc68153ea0d", "value": "ORDER INQUIRY 3756653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706d2969-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645515943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515943, "uuid": "0756f130-d41c-4859-9de8-f8cdc134002a", "comment": "Malware payload", "value": "6ff77d12466fdfa579af2904afd13845", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515943, "uuid": "4196c88d-fe34-4082-865c-3bd567edc32c", "comment": "Malware payload", "value": "9d13959b48486a0cbbaad75089d23eff070171049938d64679b90a3296b7d35a", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515943, "uuid": "d0fab93f-64e6-4834-b203-31386d0aaaa0", "comment": "Malware payload", "value": "ca163a61542fbda1613d8852d91e1719db0d33f9", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515943, "uuid": "0ea2e859-18ba-4211-b420-e9d6148f5192", "comment": "Malware payload", "value": "dae02c9894b2a502e777f82e378e2fedb2bbbb9ce4e4f49b33d12ceeeacd6faec8fdcb5596ffd40e387066c3f9b408d8", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515943, "uuid": "ddca8627-3b72-4869-9f54-f23c53f41bc3", "value": "T1AE23C01CC0815616C673693EC439C8E11927DD27A115818FD6EABE8F0BA4E9B174FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515943, "uuid": "b32e1647-f61f-4bcf-925d-51b320a1c240", "value": "768:X+JRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTW:X+XJqHt7NJECQFfqA4Oc5Oo7rg+1/K8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645515943, "uuid": "24e6be9e-37a3-41c1-809c-e344cd1b5821", "value": 47997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645515943, "uuid": "3da2ce28-aea9-4aed-9281-1d771967ca77", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515943, "uuid": "d159299c-2005-438c-bf47-249554e87852", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2be19c-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565033, "uuid": "12fad1be-8667-426b-ae9f-ff08dffe93d3", "comment": "Malware payload (Heodo)", "value": "bee39a7c85b7a8ef7485b751b3a6986f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565033, "uuid": "5a21544a-8593-4796-93ab-80b91d99e65a", "comment": "Malware payload (Heodo)", "value": "9d4e8527ac82dea4590f1b083091d838f4975a0756e97f8d35e9657177332cca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565033, "uuid": "ea517fc4-15e9-4373-b135-4ceff4c67758", "comment": "Malware payload (Heodo)", "value": "19484f77adb8dc7a7f2a4b9c6adb68534a933036", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565033, "uuid": "1fb49f4c-69a7-4c05-be34-5bb01a706cf5", "comment": "Malware payload (Heodo)", "value": "116079d1780e63dc7b383a4781c1ba34c09ebedd1e04cc13366c8e19ac48092bc1012869f76c6faf27b3bc360af9a93d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565033, "uuid": "cd0c6393-c972-4308-ad5c-a94032c447ed", "value": "T1568302A8ED52B26DC275803CC14D5CE4788E759E7004FA1E2642F66D2F436ED07CEA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565033, "uuid": "b15f1ae0-224a-4cd1-82bb-3717f0c7a9ef", "value": "1536:eWrj9WBsqxG/+CbEcWeu3XDXeoiHwt/uE1d7mT6SrPag3HtQVASxVvEfa:/rjsG/+CbE9H78wt2E1d7e6STa6SsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565033, "uuid": "60cdda44-5ad2-4b39-aa43-cf0d9ee5400b", "value": 86338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565033, "uuid": "0a761d9a-f563-40dd-ae92-8106831bee7e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565033, "uuid": "11905e04-febc-4110-86c8-8ea5550061c0", "value": "C_35988.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb47024e-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645532067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532067, "uuid": "2fce1f17-81f1-40ee-a1f5-40148087c56e", "comment": "Malware payload", "value": "cdbf6b785c8bf71ca461e7bdc938be48", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532067, "uuid": "43620564-e343-43c9-8970-071782205aa4", "comment": "Malware payload", "value": "9dbec8d2a9392e6b0271ce9275155219637cafd3d8c5dfbd586ef519b99acdbf", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532067, "uuid": "d3d61256-3bbe-4115-b08f-1d34518d4902", "comment": "Malware payload", "value": "36b2bcee1a87749ad751745ae5859fc8d81b0f54", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532067, "uuid": "6e883494-f42c-4a4a-ba38-a0a8a9939488", "comment": "Malware payload", "value": "e119d2f7ce9caa05bd93375dd639e3d0f97606f0632d6e97a29b5c3ab47dab13b4d4740b076983001dc71b6813a42f29", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532067, "uuid": "942f2b19-929f-4a09-958b-d4858ba3cd4d", "value": "T1BF41F726E3A95049E4716C3B005B3761834A8D58F3B1BE932268F853666B522B363A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532067, "uuid": "47185bb7-6312-4cea-a577-e94ea714ec39", "value": "48:98SCJQow8T2XvhWIg215VqmT/Pvsr28mfE/KQubS/:SS/iT2Xz8aJfZQue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532067, "uuid": "221be576-55ca-4514-a8f5-78345183dcfb", "value": 1915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532067, "uuid": "fafa9bf7-bc17-4a8d-87b0-3d52068c9a48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532067, "uuid": "5ac035ed-783e-45a5-9ddb-9fa26bb1c501", "value": "documentaz_801.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f31187-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503925, "uuid": "39563795-51a3-4b43-bed6-6060db8d34f8", "comment": "Malware payload (Mirai)", "value": "112e681b4efb094c79e2a3312eec863d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503925, "uuid": "1e77cf36-ad1c-4cf2-9843-12834408a977", "comment": "Malware payload (Mirai)", "value": "9dee2dbaa96fd46f5283a6f733a6f6e17fd8517650ed39e0fce5d74692169b7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503925, "uuid": "d9c9c5e5-520c-40bf-a9b0-2d68e4471e47", "comment": "Malware payload (Mirai)", "value": "3037f9a70bb6b203d83717cc76c7ec3c6c736fab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503925, "uuid": "f00e2fcc-c921-4c25-9417-ef4291997527", "comment": "Malware payload (Mirai)", "value": "a520b6be982b3416ecaf756f3021afaa063d1cce9f4dcaafabfe87537b49b270af090de0dc607347bb04cdad1d7116f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503925, "uuid": "db06637c-98e4-40f3-9677-d71b68c30686", "value": "T1FFA33CD7FC00DEBEF80AD77A45574A0A7130A3900EA30B32B2537C57BE661D46966F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503925, "uuid": "40dc237f-f320-4b3a-9e89-dab6a1a07280", "value": "3072:FptkDOns1vzEwaITsuBBXWyZTYxTx8xsn:FPkys1APIgJyZ0TGqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503925, "uuid": "0f0249b9-f5f8-4e4b-b4b8-27e364153a74", "value": 100368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503925, "uuid": "84ba4810-6e42-4853-b66e-06b8cdc630e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503925, "uuid": "de5d8364-3f2a-47da-a5e1-118ce0007e80", "value": "112e681b4efb094c79e2a3312eec863d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a2c9b9-93a7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645510714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510714, "uuid": "1fe95442-7e2a-4550-b889-d2074dfbd7ef", "comment": "Malware payload (AgentTesla)", "value": "388d0a52962a09627a47672186c7e6d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510714, "uuid": "db2c65b7-353f-4aea-bff1-d5577831b546", "comment": "Malware payload (AgentTesla)", "value": "9dfe747f5b1fa48e6bcc7445ceaf44e955bfe24304efb9812591e4265b7cacf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510714, "uuid": "d73bf6c4-2eb5-44e3-82fb-cb5a9b4b82c0", "comment": "Malware payload (AgentTesla)", "value": "4b0a50d6bb350d4b346f97c69e23d9f8077ca7df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510714, "uuid": "a3e28d02-a14a-4c33-9a25-3cb2ff6f9f4b", "comment": "Malware payload (AgentTesla)", "value": "08bc056a9800b5709e5ec844e4b9f31e19d40b50c664e8d780080d03cb44e89826654c789eb0faa56ae8530a91aa66f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510714, "uuid": "7f299ad2-e949-4553-8d18-df8a5b792de4", "value": "T10115CF043AAB0F3CF1B94BB649C1EC64FBA8E7235C19F37D7D40569ACA51B418D422B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510714, "uuid": "9743eebf-2add-464d-b12c-b6ec3b3eec8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510714, "uuid": "7eda50f7-1f74-4021-a259-1868ed5bac41", "value": "12288:3gB6AXnNfh7jWkjRVPLhSbxWlLM/kTyMhG9+qTs/d05ociX88wVsT4ujh:0XnNki1I9eYW/QI8YC5o54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645510714, "uuid": "7fe43f81-6281-4160-9004-7126c8d255ed", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645510714, "uuid": "b3f4b4de-cb84-4af7-bdc7-9c52bb2e7d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510714, "uuid": "ccf10569-f51f-4e19-8125-0538c4dcdc76", "value": "payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0754283-93d9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645532425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532425, "uuid": "a22960a6-e62a-42f2-be2b-cf8260051caa", "comment": "Malware payload", "value": "15375ceb3b486a249895eb02a9d44d37", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532425, "uuid": "9520973d-a3af-4ca2-9441-486af95ea18d", "comment": "Malware payload", "value": "9f974608daa7d320fee3218597d0ed28ecd5fcfc141afef4f6f6e594aa364961", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532425, "uuid": "5685389c-13dc-4099-8824-851cc9846ab8", "comment": "Malware payload", "value": "5552679d71764f73ee051ce64025ae77706e50a4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532425, "uuid": "35e4b816-8af8-432d-bf29-59f383c1864e", "comment": "Malware payload", "value": "9f66a87415049e5b356ef78e12f00c328ed789e82523e07d99269b4ca5da8b3c95c24719cf847631673388a296f61149", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532425, "uuid": "09ab3e1f-01d1-4d48-bf51-c7a75d20e08e", "value": "T12F65E181B7C4BC2FCC7384364FBA8A2A94464C46CB46D71759A1B62C9EBBEC05E45FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532425, "uuid": "8de402fc-1116-4170-b992-3906625e4c6d", "value": "24576:HHFkJyg1qs2sxz7GWGtpnN6L+aCnNuh+VzfuVQaYFI03ePq920qIPi8bKKQOUqiP:HHFkJlgazqWGpMyEmzWVQaB0uS9jqIPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532425, "uuid": "9e9f9c77-1083-40e8-a371-f3302cbb7a10", "value": 1483030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532425, "uuid": "3096a5ca-d38a-4b1f-9199-3cb2b47fadb6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532425, "uuid": "ccc7694b-19b6-49a9-ba83-43e36433f931", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ab1e63-9392-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645501852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501852, "uuid": "99457773-009a-40b4-9bb6-e3ad7d7dcbd2", "comment": "Malware payload", "value": "be14914da9ea07613c64560ec74ff86b", "object_relation": "md5", "Tag": [ { "name": "PHPWebShellWebAdmin", "colour": "#0DB850", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501852, "uuid": "892aec70-5d84-4bf8-88b2-e6b195f65605", "comment": "Malware payload", "value": "9fb90a2e13618f1696ad2d4cc1a02c199f9cc47dce1e75da650cbebf4d02019e", "object_relation": "sha256", "Tag": [ { "name": "PHPWebShellWebAdmin", "colour": "#0DB850", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501852, "uuid": "3540839d-ef64-4548-9897-20a61b9993d3", "comment": "Malware payload", "value": "60776dd16646e4cc71031d791993728ab1c8d51b", "object_relation": "sha1", "Tag": [ { "name": "PHPWebShellWebAdmin", "colour": "#0DB850", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645501852, "uuid": "844b7305-3fc8-491b-8e93-b8a542a30ffe", "comment": "Malware payload", "value": "b47c7376d0590ed46a9385e588eed080cb184baaa1dfa6edca0734e50cf4f0a3e9ffcda1b55db65bb33e159d2e76d431", "object_relation": "sha3-384", "Tag": [ { "name": "PHPWebShellWebAdmin", "colour": "#0DB850", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501852, "uuid": "7f62ab96-1ec0-40da-ba09-74b9ccb5a9e5", "value": "T152B45A870544DBE8CB6FF45D92475C0AC6EBA35D2A5C84B166AB1DC4F332C5CA86BCC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501852, "uuid": "4f819e02-6254-494e-9bb7-2afb80567575", "value": "768:BY4sHYlemIQNbzUk+OBT6rGuJJtvzwNUhoEgubeG/g90rwXyREDrauucXcRk8Zak:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645501852, "uuid": "28c6f296-0e59-4c1a-9c47-d9600cb9888a", "value": 494760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645501852, "uuid": "c62345a2-1d10-4a6b-8aed-fb9e5afcba76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645501852, "uuid": "c1544597-4ea2-407d-b75d-1fba8189681c", "value": "zazjxvaa.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4ffc60-93d1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645528957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528957, "uuid": "1c9ac15c-221c-43be-a67e-75744fa076f7", "comment": "Malware payload (AgentTesla)", "value": "ba01c389c3d9e89614a6e2677277da57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528957, "uuid": "00caad7b-dd60-45c2-be0e-9578899f9c10", "comment": "Malware payload (AgentTesla)", "value": "a0ebed655c76dc37cf93b62042263ae665d39a03a5470a6c6d5cc962541da75d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528957, "uuid": "853f5b46-a17a-42e4-aed6-82595afffd7b", "comment": "Malware payload (AgentTesla)", "value": "54443616751d3c3c3c612587424b48fbb500b97c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528957, "uuid": "7924a2ac-02af-4779-b096-e53adefecc58", "comment": "Malware payload (AgentTesla)", "value": "52b8014cfb68477c51f95b6b4b43787325fe01fee7af7dfe9ac1c1fd56837d6332fe830ce71a3fd152c194d2222c450d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528957, "uuid": "70e44a54-aed0-4d72-9bec-2ba659a2187c", "value": "T15CB3FD50E94DACD9E7E8C1B3B93A9B100575BBDB92F8819F2265371452B37C320B7D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528957, "uuid": "3a87784c-aa30-4242-a473-212c37f2783d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528957, "uuid": "76ed11ff-6624-44c0-bdff-586b980692eb", "value": "3072:xb7Dry8o05lhUqrAMgTPA1p8Dja+auDOLQyDl9hFjO4rW6ZQY7j1lQ7wXVA0+bi1:xb7uCvK4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528957, "uuid": "6331073b-b70c-4727-bce2-fe59ed7546ad", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528957, "uuid": "f68f3438-a12c-4f28-ba47-ce73ffa85390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528957, "uuid": "582468db-8172-4c00-b081-b8075e8058c8", "value": "Rnfolthv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c0d9c2-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554978, "uuid": "2da2fba0-05d7-4578-ade5-9abfe055c334", "comment": "Malware payload (Heodo)", "value": "a742bdafea88f8f6f5c5f67f1268778d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554978, "uuid": "9b5a45a8-38f2-4c40-9ad1-be2b634afc03", "comment": "Malware payload (Heodo)", "value": "a0fa0f6db2096f2a516d9a326c41a5924f67c959e0b921e2991d9967c51eb7b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554978, "uuid": "a43b76a5-e4d3-4357-afe7-64a166023522", "comment": "Malware payload (Heodo)", "value": "531067bfd9b3d996dd67ff594457eabf846a4085", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554978, "uuid": "a698cdfa-764a-46ae-a239-e06e3dbddd77", "comment": "Malware payload (Heodo)", "value": "2aee6435bdf2b20ef183e5bdc7f7df55094b1608e1806a1dab785c0caf83544360d52115d27a37682001568ab9f075e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554978, "uuid": "5bc65b71-9d40-488f-8b12-9f5a8c3564bb", "value": "T199A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554978, "uuid": "4fa895e2-a9bb-4502-a509-27fcdd10f57d", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554978, "uuid": "e6f6e6de-cab6-41a4-9978-8e7b9f0612c4", "value": "12288:vicw4w2Vb0zq6k5Z2mTujqkGXNrGHORQuBT:viSwub0W6LmT6wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554978, "uuid": "e5d03a97-dce3-4989-8cce-4510edc77b6c", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554978, "uuid": "a9163a34-e893-4d2d-bf3a-65335b765a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554978, "uuid": "b3d46fdf-ec16-4e02-8c09-acffd7882f29", "value": "a742bdafea88f8f6f5c5f67f1268778d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4469b169-93c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645523171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523171, "uuid": "a7f80579-8b0b-44d2-8a59-40a3a1d96968", "comment": "Malware payload", "value": "f92211bfbe01b11b009be1f1927869ce", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523171, "uuid": "7f1472c0-3e03-457f-b8e2-d78c1a4177bc", "comment": "Malware payload", "value": "a1a2c3cbc90172493471ddc234a8909ddb6e6a7639c5c74005269bdaf13d442b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523171, "uuid": "fc7cc09a-ba2c-41d1-9f22-0b0647a09330", "comment": "Malware payload", "value": "a501f08c7e9c7b4a8b8cc50e7f03c3991cdda420", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523171, "uuid": "f55487c1-7a73-4320-a15a-64c50817002f", "comment": "Malware payload", "value": "e0642c82fe75a5111b9569c0b868b914a98104e1b902c5eb9b8910b2ea2f37f60199acce2d47758f61bf23c86d34abe4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523171, "uuid": "4b276edb-4440-459d-929f-f00493e34076", "value": "T18C860156E768A93FC8F38332067A5635116BCD268B439797191C323C68B79EC4F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523171, "uuid": "baf5b8eb-37fb-4a27-bdcb-fa40e4a70ad4", "value": "196608:KcniH5N2+JuoEAEY/JUISS3sYnyyb1ZrMlbByhSEfRf2xm7:TnC5N2YEY/J9cYyimlbB1iyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645523171, "uuid": "73e3246d-aa5f-414d-ad79-f2041738cdcf", "value": 8431647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645523171, "uuid": "991c8761-d156-437f-9ae0-8781fe0ad13d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523171, "uuid": "b6c6ae8b-b035-4cc3-b9b7-b7c369dd03be", "value": "Blood Sugar Statistics.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732ef1ae-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564910, "uuid": "e650338a-9997-4f19-b5a6-fe6529697406", "comment": "Malware payload (Heodo)", "value": "e38f86ea8ea6b556e2472bf512d3f5cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564910, "uuid": "f02bd1a5-182d-429d-90f4-fc33ddc253ae", "comment": "Malware payload (Heodo)", "value": "a1aeb99c8f4e146ba6fe6a6bd1d9cf35cefed71f68f60088e4488647cc191028", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564910, "uuid": "ddd4b39d-415d-42cc-b8c8-b9266cc9d9af", "comment": "Malware payload (Heodo)", "value": "116ce1b4c3abd6dc9b7d1f26bf5d644dc9921a33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564910, "uuid": "fb57a9e3-5aaa-45d2-b275-28bceda8083b", "comment": "Malware payload (Heodo)", "value": "52a08f323c30a0ca259c01524fe2206442c2c7ba57652e01b80caa533f5961432f97218f4235d49e316835babb7fe54e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564910, "uuid": "35fe77f9-4594-442c-969c-dfa8dfe43c4b", "value": "T1A0A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564910, "uuid": "9e1fe304-4a30-4340-9666-6fba1a6214f1", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564910, "uuid": "9412acc7-b921-4d9f-a6c5-ba6a807bd3b1", "value": "12288:vicw4w2Vb0zq6k5Z2mTWjqkGXNrGHORQuBT:viSwub0W6LmTiwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564910, "uuid": "19929cf7-9897-49ea-ae7b-cb60cced493b", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564910, "uuid": "ec79e8e4-2fcf-4e4d-88ca-d6010720e99f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564910, "uuid": "ec6b8019-65ff-4c91-a3ce-e7769487a04e", "value": "u8wpVVhKK9B7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d40618-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645554897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554897, "uuid": "ae526083-d611-4257-b8d6-cf947169b754", "comment": "Malware payload (Mirai)", "value": "f3b5794d63a6b8fc84b7266833908b82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554897, "uuid": "e372b2c4-3f8b-4a5f-b18c-f5b91f23d64c", "comment": "Malware payload (Mirai)", "value": "a1bbdfb487f60e7df1bb4297378e718cea929bc4b35c8461b0fdda8fdc7db949", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554897, "uuid": "18faf43e-0120-48b7-b3cb-61aaf68da986", "comment": "Malware payload (Mirai)", "value": "6511ace01dca81a92fb695ed97499c8aa2aaccc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554897, "uuid": "a9bd2439-62a7-4527-8c79-afc5673544da", "comment": "Malware payload (Mirai)", "value": "71a62e60098cddd3af981def14b22cd7142747ab9dcfdd6b672b5f20e662b49dc5c972f0ac10e3caa75f4c75f8e877e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554897, "uuid": "52c44a54-a074-42ce-a47a-d3ba320953b3", "value": "T12AC2F845ECD28A26C9D06B36FE6F499E3311A7E5C2EE3B03CD151B013286A5E0E77553", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554897, "uuid": "add5fc0e-368f-45cb-95b0-bb25097c5f55", "value": "768:C57xHy0eQ9PYUnEJDFVcW7URO++KWmwcXoIx1rBN11or:C5hNr9hnEJDF5ATwcXoIxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554897, "uuid": "8b965adc-6c05-445a-9668-bc2c48393027", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554897, "uuid": "0d3dbbb3-f171-4c0f-9f9e-0f4dfcc26094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554897, "uuid": "6cb093be-760d-445a-b538-0064fcd05d18", "value": "f3b5794d63a6b8fc84b7266833908b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d133428-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517575, "uuid": "90bb2d5a-de38-42cf-a933-29384643e26f", "comment": "Malware payload", "value": "4d92d4f91f510d38db719531ac3b64be", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517575, "uuid": "850aa72d-75fc-45ba-9f15-dd6b8c83691a", "comment": "Malware payload", "value": "a25215c9adce51a3ecfe34c802d3e7d865cf410ddbe10101e3b41f6ba11347a4", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517575, "uuid": "b069f2bc-186a-4078-a67c-f6872024fb8a", "comment": "Malware payload", "value": "b2cdd44a62941bcc7a9ddf076c927dbfb90dcf2a", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517575, "uuid": "92d9add6-b6a8-44b7-9a32-6abc2365ccf8", "comment": "Malware payload", "value": "110572788329891e4eee42ea3746f107ccd677edb09f1ed94877aaa79d95df5e47303afa7d4af0d4129b28d53c18cbb0", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517575, "uuid": "080deb54-c276-4397-885e-67639c8495c0", "value": "T1059533E97EA50226EEB6173CA49DC069E433BFF53C83F49A4408CAD524B92F5F264135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517575, "uuid": "b8025237-7e23-439b-8d05-219ecaf98f6f", "value": "49152:gN1daZKkGiYE3CVnIEu0WQmQWwBPY0e2jLIR:gLdqYEgnlLm2a013e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517575, "uuid": "510e19b3-0a1a-4f13-92d4-f5bbef27789b", "value": 1889587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517575, "uuid": "b69371eb-a728-4f9b-ad3c-d5a48423e1ec", "value": "video/mp4", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517575, "uuid": "3684ad76-9361-435a-8dba-f87645cc0aef", "value": "a25215c9adce51a3ecfe34c802d3e7d865cf410ddbe10101e3b41f6ba11347a4.mp4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43edc85-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528137, "uuid": "3eaec69f-1db9-4d06-8d6c-e93baa584df3", "comment": "Malware payload (Mirai)", "value": "ae587699f7ed92718a642cd4eed394e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528137, "uuid": "83420e65-af63-4186-b20b-2df7dac2fe88", "comment": "Malware payload (Mirai)", "value": "a2a69eab00e9d9de3940cbb2eb1a5c57d2688b12d0c51c0cdbae59dd4d480d1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528137, "uuid": "4007e2be-8b95-40ad-ba6d-1cacfbad6975", "comment": "Malware payload (Mirai)", "value": "bd6dff488cbe0496b56609b474f0f89ae8ec9971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528137, "uuid": "c0e24a9d-e363-45a4-ab77-cc88d3b24651", "comment": "Malware payload (Mirai)", "value": "c343c6b8bf79356dcda1c4f57251f3277da53b246fec3a4a2f23af7e8467e9ca5d9fcad1150ed5f613d4a199405e0ea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528137, "uuid": "9245a44c-2ac7-4445-ab3d-ab64bd01b1b7", "value": "T134531755BCD28A12CAD462B6FA2E418D332663E8D1DF3207DD216F1137CA82F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528137, "uuid": "d6e58e1c-d973-421e-9a62-1e846263fa43", "value": "1536:BQXM2P1+Z5c6jQFqBqIESVrL2yBCtt5Kv2xJSk:B6b+Z535lvYbKv2xwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528137, "uuid": "60803f2b-a2c6-4930-8350-c7d1d75f916b", "value": 60796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528137, "uuid": "b3124754-151d-4fcb-9d1d-0996cf6903b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528137, "uuid": "36f6781c-79f0-4726-888b-fa7fef240158", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27062480-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517538, "uuid": "3413fb6f-71e2-4bb6-b63d-f7949dd09679", "comment": "Malware payload", "value": "0d649ab94891128ef7bfc50207c843da", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517538, "uuid": "b8eed1a0-7b8b-4905-bb6c-eb5d87bd862b", "comment": "Malware payload", "value": "a2d493c2cb25fc03f5d31cf3023b473d71d38b972eccdb7873f50d2344ea7753", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517538, "uuid": "d964b191-7ca9-41f4-ae57-0f8f3bf93dc5", "comment": "Malware payload", "value": "11d50952fe3364658108070ad237f3d1803e6869", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517538, "uuid": "3a4ea95e-8bea-4b5a-9a54-1a555d835f4c", "comment": "Malware payload", "value": "d5ead8a713faf6480b89490b61c27e4fbcccf2116396bfba1764e77e1da3b010f93aa44610a107763e0616a3e6ab0daa", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517538, "uuid": "a5490202-c71e-42f1-83d9-8f34ce5da4c6", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517538, "uuid": "c69a55e1-45d3-4954-8e65-2519312d1b42", "value": "3:I5SMAb9acs5n:Ii9Xs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517538, "uuid": "1e5176d8-c777-4779-a5ce-ef381dfa0253", "value": 33, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517538, "uuid": "8e43e4ae-39ec-4d6a-a211-d165c6e8e725", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517538, "uuid": "667b9f19-ea43-446c-823e-af99c08bcb99", "value": "a2d493c2cb25fc03f5d31cf3023b473d71d38b972eccdb7873f50d2344ea7753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982004a4-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Clay)", "timestamp": 1645518157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518157, "uuid": "98a64823-7cfa-4dc0-9ffd-73d7d0733d30", "comment": "Malware payload (Clay)", "value": "aa1b2c820a117e307bffff79848b6b6b", "object_relation": "md5", "Tag": [ { "name": "Clay", "colour": "#E03D23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518157, "uuid": "1d10d155-59a6-485d-b609-39477a4a4a3c", "comment": "Malware payload (Clay)", "value": "a2e52e7399075696d9742180c1860ace7644c4e7b8e4abb793dbd15b47d0f0c8", "object_relation": "sha256", "Tag": [ { "name": "Clay", "colour": "#E03D23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518157, "uuid": "07217c4e-1203-4872-9c7d-be9740815b3b", "comment": "Malware payload (Clay)", "value": "209870d8a9db9d3757152784ccc8ae368efd9340", "object_relation": "sha1", "Tag": [ { "name": "Clay", "colour": "#E03D23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518157, "uuid": "ffcf9032-6e7e-41e5-b1a6-f41069ccd05e", "comment": "Malware payload (Clay)", "value": "0617b650ff354dfe86bd9d1d45518c4cdeabf342e2594577556ab133ef208e90bf02c5c43d5ed41f7e5172a7aa9fc914", "object_relation": "sha3-384", "Tag": [ { "name": "Clay", "colour": "#E03D23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518157, "uuid": "28a7e1eb-97a7-42c8-96bd-9e937d1e5e67", "value": "T10AE37C51769CE67AD56803F92876C1B853759C0E2C02C72F39C5BEDFBFB27118A421A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518157, "uuid": "111d39af-9956-435d-8513-f73f418686cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518157, "uuid": "86171b30-7292-466b-8b0d-7dd139135274", "value": "1536:RcVi/ILecfQjUho9JdZ5822McocedwVcl:Wo/YecQEo9JdZ5rRvzdqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518157, "uuid": "96b277cf-c7bd-423e-bc3e-da2f46e7a18c", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518157, "uuid": "2b6f1273-4fbf-4478-ac4d-8d92e9f0d4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518157, "uuid": "be6424df-9a8c-40ea-aaf2-8e59d8990ceb", "value": "aa1b2c820a117e307bffff79848b6b6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadf1355-9414-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645557810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557810, "uuid": "1b390061-ec7b-42ec-9d54-f613fc94d4dd", "comment": "Malware payload", "value": "d8aa5c972fd8ce9809314b87eac0e6cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557810, "uuid": "deec48a9-8176-4719-bce9-063413e141d7", "comment": "Malware payload", "value": "a3001260ed9cd27d3be4d86374e2d86e57e0c2fe0a35de7ca4d68acaf7f5ad6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557810, "uuid": "5102a77b-813f-482b-881e-d1cee41acae7", "comment": "Malware payload", "value": "50f16cdf318b93a64564d7bc6a7f141c27e35f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557810, "uuid": "f3aa007c-d368-49bb-9d6e-56e62e1d6ef9", "comment": "Malware payload", "value": "5b4a7754f6bc257934e29d5bdbb26062b14f54ec3c528fac521f780aecb01c6bcbee07e25841d0112c7c84fe70d70fd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557810, "uuid": "67048c4c-29af-4e0e-aea6-5cf571888bed", "value": "T11F24F7A6C5FC1C47D94BB37854262D1391CE4E7280D5925A0B98BC3AF3FE9E7A4141D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557810, "uuid": "8f6f36c4-4f76-47d3-ac9f-4699fc71d04c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557810, "uuid": "21cc7217-01ff-4351-b193-cce623961ea2", "value": "3072:itpZAXMZUFpTU+wSZZPSj/j+LWrny2QXea9VSsumMMcZ3:ig9wAVSjCLWLy2QXea9smMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645557810, "uuid": "78332aa9-19b5-4abe-b2d9-aa442a3f8ef1", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645557810, "uuid": "1d73641e-dedb-47ea-87c5-574e9396b459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557810, "uuid": "06da2b08-5b5d-462f-baed-498633a70d59", "value": "SecuriteInfo.com.Trojan.DownloaderNET.322.17731.19437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df12bbfb-93d7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645531591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531591, "uuid": "81f94e53-5faa-4272-95fb-26dbf6c2b85f", "comment": "Malware payload", "value": "6750fdc2d1f31cb038168a9a546bfb88", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531591, "uuid": "70579d69-822b-4a15-8d03-a41110daf7de", "comment": "Malware payload", "value": "a30be061d373845f26e4f9303566d55a6b322f70d2355c29b99bb9a0ca484afb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531591, "uuid": "73066f60-9799-49f9-b7e7-19803d6ec993", "comment": "Malware payload", "value": "fbd7eb6161eb64a0f3e3080348eaaa8b310e5092", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531591, "uuid": "d5a5ef52-86d4-432f-8ef8-9f3786250e36", "comment": "Malware payload", "value": "a5a90c8328fa230db29bb510c5a52121a9624097aa325d68532c0aee6cf5ec8cebb8c06d1404866a13bab47ecb523da8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531591, "uuid": "209adf44-37a9-4553-a1fe-fcccd9953e61", "value": "T14E65E141B7C5FC2FCC7384364BB68A6A90468C96CB46D71359A5B62C4EFBAC04E45FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531591, "uuid": "a158143e-21ff-4758-8a3a-5f72155fbd17", "value": "24576:su+Lp4jyflJaBUH4t0CkZn1ay4/Ez2myBx0x3ePq920qs72CvDrmPgv3iBl:Fm4mtJVH4aJZn1548zi/QuS9jqs7PePH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531591, "uuid": "c0b029dd-0f54-443b-a0cc-357ee99d9f09", "value": 1493823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531591, "uuid": "38fd7ffe-1037-47b7-a13f-7b5d7901ec21", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531591, "uuid": "1f318203-3944-4422-83b3-358f6b3a8307", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ad6038-939a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645505431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505431, "uuid": "dd855f3f-a5a3-4f83-a679-ddfd7121863f", "comment": "Malware payload (RedLineStealer)", "value": "12f91759bf03270bc5793a94c45a9117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505431, "uuid": "e345ad7d-c366-4c0a-9aca-1955d9c92d6f", "comment": "Malware payload (RedLineStealer)", "value": "a35becb58b89fcc7864acc58f4a6b1614eb596fd6d2ea15024fb7f9af59b680a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505431, "uuid": "f631e3cb-de13-4c51-b4bc-5886bce1c748", "comment": "Malware payload (RedLineStealer)", "value": "55887b7eaab02f0d2cbe7ff45589266f320b634b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505431, "uuid": "75ee67e3-5a2d-4471-bd0e-3e075d5ec9e7", "comment": "Malware payload (RedLineStealer)", "value": "578330b7dd67ca899a9a0287620fb44450a9e700aad0152d36978ca67e462f8eea1c17c2c16cb64aa27cf858c8506d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505431, "uuid": "d29bdc91-a80a-44c0-b8f5-bfe2a22e7e0b", "value": "T109B533B0BB66706AC049C5FC1D732B4BD7ACC15D790CBF7A0431BA467E29E158984EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505431, "uuid": "b49cf8a5-0f3b-4227-b793-f583af90907c", "value": "91652763f0bbbea350f45a6d7107e373", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505431, "uuid": "b4918f20-f1ee-4211-9926-86b3fc3c05b2", "value": "49152:2iHu9mnoBvjUjukFGnShF7RJj8xmocdutURZ/kNwiQJI94:2iHusnC7UjuxnSHP4UlZ/kNwLJI94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505431, "uuid": "eb9b438d-e1a9-4cb9-9ae3-3048eeabfb5c", "value": 2469888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505431, "uuid": "33a35487-d235-4aaa-9320-5d87b0deba5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505431, "uuid": "bfe118a8-7d92-45fc-9b2f-f9c2a47cc901", "value": "Ezgame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841b3cf1-9420-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645562791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562791, "uuid": "4d0df9c9-2034-4032-b9b9-9bf3824593b5", "comment": "Malware payload (Mirai)", "value": "86651c0b59d824e689b7c314c18cbd60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562791, "uuid": "86d736c8-98a9-4bb3-a439-e948f32a954e", "comment": "Malware payload (Mirai)", "value": "a374da258727e8b225996d069ee3e3f2db6e9e5475d06c42937909fd8df325da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562791, "uuid": "6f767988-97f0-4e11-88b4-f4ba9d39d690", "comment": "Malware payload (Mirai)", "value": "8c0d527a7ebe2cc76b3cc0907e796a5b2cc43e2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562791, "uuid": "0717c909-dc5b-452d-899a-5400e82921e4", "comment": "Malware payload (Mirai)", "value": "5b5fbfb13b87f93f70893d0c5b099d62224ea58daf6309ec8d3ff1356153397015f58f935d04f18a69d7c9516d31dce7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562791, "uuid": "2c884b33-bdec-4717-95c5-8c5d9ed070fe", "value": "T16DF2E004E0564ADAFCBAAED76790C76533419FAA774CDAF728D67B537127C0A2410AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562791, "uuid": "a35ee594-6d7a-4254-b1a1-672e62acaf1d", "value": "768:U2cdYGckfn+p4ZN4ERwaAT3p4D3yJeqSX5c6nV+Chto/4uVcqgw0zw:U2U0kfjZN3jYm7X5jJtQ4u+qgw0zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562791, "uuid": "6e80a1cd-ef7e-4fca-9d96-3cf601086e18", "value": 34292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562791, "uuid": "4b35b10d-8860-4521-8e63-2fe9948f2750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562791, "uuid": "04893196-bc4a-4f5a-822a-7150dfe5493b", "value": "86651c0b59d824e689b7c314c18cbd60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70716873-93c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645524104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524104, "uuid": "a6863840-6781-4b6d-b8fc-b6218a62cfa1", "comment": "Malware payload (Formbook)", "value": "e72f5267c826ebaf46fa3afc91345b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524104, "uuid": "4880dc2d-bfc4-47f5-acab-211c1d749ced", "comment": "Malware payload (Formbook)", "value": "a3bc064d41d820f61a1991f8c6e0bf3d367ee8633f61506a12b0b0ff2d4fa13d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524104, "uuid": "952127ae-ec62-4b40-98f1-d7a4dea84d6e", "comment": "Malware payload (Formbook)", "value": "b704793b33fe59748f2d9b16bc45436100f8f1bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524104, "uuid": "0f8e55f4-1acb-4556-957c-65381b50d2f3", "comment": "Malware payload (Formbook)", "value": "4e87ece14bb21d73859db05e630ea6129279066513d490d2bcb29ecfe568e56a3d7b92b74761e4f1ba41fa21d13f4e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524104, "uuid": "c8d36e3e-5641-4afe-91fc-84b61db8e302", "value": "T13534123568C4E5C7C9C206302AFFA77193B6B3151270094B7F6E0E9A6E62807D9877E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524104, "uuid": "59c50e9f-01b7-443e-b22a-57a2d652afea", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524104, "uuid": "19999c5b-45fb-45da-9756-630a2f380d1a", "value": "6144:TxDrpZlD8ObaR/Jhqe086tPvKhVLUga7OusM08+7WRK:jZ+DRhhi86tPQVw8NWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645524104, "uuid": "35695309-0ef6-4c26-b216-e52758fb67e1", "value": 241885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645524104, "uuid": "dccbd047-d277-4036-b789-bece09d212bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524104, "uuid": "2dc8d42b-817a-4e86-b304-a5dc2266e513", "value": "Order-FZ051193741-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05de0d85-93ec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645540246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540246, "uuid": "855c4a0b-75e9-43e9-bf78-b9e7669ff158", "comment": "Malware payload", "value": "92a78894568e2e7869ef7ec454c52db3", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540246, "uuid": "9ae96510-5622-47ab-b3dc-5b51d3aff643", "comment": "Malware payload", "value": "a49bb6f6be5b597cd7ac592faa01f857060f3694c1bed69f8c8c0cc029b70069", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540246, "uuid": "0caef954-03eb-4c37-b18c-0345ec86b12d", "comment": "Malware payload", "value": "6987e216d2b7477f593569576babbb499aab2e94", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645540246, "uuid": "22ad8b0b-11a0-4f44-95d2-d14ff1fbdfbd", "comment": "Malware payload", "value": "7b845ce46d0f88f334fac7c5a9ac3e40c8678f3839fcd513c60356ae801fb1b1dcb4824839b035416149306d44f72621", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540246, "uuid": "b47f1c69-04db-4063-bcf0-a33c54d282ab", "value": "T193D3D4EBFD81C70BE29EC63009ACA5D593E9AD3997CB83C6FD4972490D32691C0B1539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540246, "uuid": "e8298ef2-65b5-42b9-ba77-13325952b7f2", "value": "3072:3lxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA6UfctdlXjWhfThC/KjM6u:VxEtjPOtioVjDGUU1qfDlavx+W2QnA17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645540246, "uuid": "a9a220c2-2852-422a-af50-39f1493eff5a", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645540246, "uuid": "ae42c3f7-07ed-485e-a01d-5b78c8a3e0a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645540246, "uuid": "04b75e62-078d-4695-82e2-234b26fab118", "value": "Scan Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f22c2ff-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490064, "uuid": "b9a05094-b43b-49bc-a202-820441e73fd1", "comment": "Malware payload (Mirai)", "value": "816dbc93c7456d65e8e6c4d5f0396f60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490064, "uuid": "8a6406e4-7f0c-4aaa-b7ee-75983433bddc", "comment": "Malware payload (Mirai)", "value": "a6c9c4c07cf6e0ca1a2197c993190a3fc21aedfda2914031837e6fbf31eb472b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490064, "uuid": "bfdb9454-e4fd-4b8e-9043-3d38b5d6772b", "comment": "Malware payload (Mirai)", "value": "e86a55ff93ce7342e4833c11c0d1f399a3361300", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490064, "uuid": "2e42a7ed-523a-4328-aeec-356629a90225", "comment": "Malware payload (Mirai)", "value": "052143151ce3a63b51d4270b1a630c08ffa9c03b8e4e28fae4dc793d05fab6b8a1cb0fd5b678e5e0d5ebaa51447b5947", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490064, "uuid": "cd0d3c80-6d0f-4ac0-9ec0-b5049a988740", "value": "T11F636B24AC792E27C1D4B17B22F7C361F6E6220E25B0D61D7DB20F8EFF1068465562B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490064, "uuid": "20d8e470-d29c-49af-8fe2-4e9d16495a56", "value": "1536:yImalbd0SiUQFVg1TttrcTKQJ0F86vo/phX7LAOFe:xLBK8xttrcTWTvoL8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490064, "uuid": "890c05eb-c5fe-4b34-9cdc-d2944c052670", "value": 71020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490064, "uuid": "f7b92cf1-d76d-4025-ab4a-965590570f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490064, "uuid": "f518a1ae-2d95-413a-8782-4e76c2b8ebfc", "value": "816dbc93c7456d65e8e6c4d5f0396f60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e9b10d-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645516026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516026, "uuid": "f520ded8-275c-4daf-8aa1-f1f835781c44", "comment": "Malware payload (AgentTesla)", "value": "c68f4de39f86874a7c33f381f0a12622", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516026, "uuid": "00e559f5-dcb2-4f7b-9ba3-11ce83da625a", "comment": "Malware payload (AgentTesla)", "value": "a78c9271d4fac06b674c19653cb2d927013dcfe7429513b7c9b0595275eb20f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516026, "uuid": "47d5dafe-33e6-407c-95dc-3fd3b9f36bb8", "comment": "Malware payload (AgentTesla)", "value": "0166b1058b3fc15ff30af8c4a7ad290c11417608", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516026, "uuid": "224bf56c-751b-4881-98fb-a0557898aa8e", "comment": "Malware payload (AgentTesla)", "value": "2e0c5776be32caf5028f95c51f101c88c3522d74e105b96b48d1be42302c66471be6941e30ab6e478fc7ba3fcfdc52e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516026, "uuid": "11be8ccf-b019-4d83-a2f7-dc5044475d2b", "value": "T14415CF043AA74F3DF1BA4BB648D1EC64FBA9F6231C09F37E39505196CA92B408D42677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516026, "uuid": "16dad0db-9e52-4f65-8a48-d60ce362f4c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516026, "uuid": "477a6094-dee1-457a-87d3-3571320a5f76", "value": "12288:phbpGgB6vdNKh7j+/KTfyjsdSLNZvmoVcZeYzxt3DBsMaz/pBvIob/P9v3Gh4FJU:phbp6dNtCT2seceYzxtN+7g+Y8Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516026, "uuid": "fc19963a-06e9-47eb-b78b-c7ec9609c177", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516026, "uuid": "8b56ca62-5466-4655-ac95-6e8cd660465f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516026, "uuid": "a1ca5f3c-bc35-41af-a3f7-95e25a34b202", "value": "R.F.Q_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d81291f-941d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645561411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561411, "uuid": "dc0ef26d-469e-49e9-8437-ed1ae0634eb4", "comment": "Malware payload", "value": "0f7a3d499db481c0a6938a32e22074be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561411, "uuid": "09f7ad1c-28e6-4c52-a521-554370d27c87", "comment": "Malware payload", "value": "a80d7a2da8c373a9087cc7bb556bfe243019fa6c78714888ffb17e5ba0499648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561411, "uuid": "8f158a0b-85d7-4fe2-9d2d-7f487aba496c", "comment": "Malware payload", "value": "9e45d9f426d6bb886676e73bb2a9bb8ccd591f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561411, "uuid": "3903884a-4eab-4ae0-bab9-1f60647f74d4", "comment": "Malware payload", "value": "bfdf1de9fd5b6e77f5ad297336e48c34cbd40f1f6886e764c418bc1490491b04017d47662c50df76e484cdb4b103043c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561411, "uuid": "de49cb0e-655a-4db0-a677-d18869770d29", "value": "T184D412562021C5DFE2E202360825275FA6F0AF622332A58F57507EBDBF75F919F65302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561411, "uuid": "fca7dbe8-0622-4af1-a1b7-58236f5051d2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561411, "uuid": "ac7369be-6b04-4e01-9d68-a3455d61067e", "value": "12288:zb6UG1NAN8Axjam22QMPnJjUisFtlH2UMq2PZgue0yzgX3GXfl5OzE:zbm1YfV2vhFtlH2UgPZgpgXWXTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645561411, "uuid": "14eaa97a-b32b-43ab-a99b-a428c34c4ab8", "value": 624712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645561411, "uuid": "68344d9e-ee67-459a-9b0a-c72b618d67cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561411, "uuid": "b0d43686-e99b-4f74-9234-af8f1091dce4", "value": "Payment _confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c592cf4-9399-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645504608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504608, "uuid": "4afaabcf-8116-42ae-ae65-0b9d0becf2da", "comment": "Malware payload (Heodo)", "value": "ae515d1f0369e46f24790d7df0ebc8ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504608, "uuid": "2949d55d-f960-4948-8d83-ec3c938807e8", "comment": "Malware payload (Heodo)", "value": "a896db78a09a3f4e133640e25fe0d8dbbcde55733835ff6484fe65e71dc4e0d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504608, "uuid": "cb915e63-e962-4c94-9ded-c00ff895567c", "comment": "Malware payload (Heodo)", "value": "e00d5bda5a50a4ac9a700af149740b2f30bf1502", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645504608, "uuid": "f5a496e1-ecae-48eb-9608-aa64ae7d3ab9", "comment": "Malware payload (Heodo)", "value": "79e32d04f604f9c82969ed8db6fce75cb37b288a816172d201c024d10f345954a29d7508ba07c55df23fabc5cc67b015", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504608, "uuid": "3ce86c39-7ddc-4a10-9a49-8891a4ca01d4", "value": "T121D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504608, "uuid": "b3f31266-fe94-49f7-90b4-ee85d80a10bf", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504608, "uuid": "445c8ff5-94cc-4657-8ffe-4bd27811c6dd", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBP+7+7/Q0xIop1KpR:JynoxcCOllFxBP57LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645504608, "uuid": "36ef3ab9-9bc2-4900-928a-34dafbf8825b", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645504608, "uuid": "b462f5ce-a759-437a-90c1-df9b4e88de81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645504608, "uuid": "a4d306ab-7611-43c6-b4a1-fdd5a4a5a110", "value": "emotet_exe_e4_9ad13152ff3fe66507e76dfd3b4e988f7b015a203a5a58dad36b685dae132190_2022-02-22__043643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ce6c40-93ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518776, "uuid": "9edce1e3-cc66-4b7b-a62c-67a4b5ab4069", "comment": "Malware payload", "value": "e99b341dfd3147e5bbb385e7cc5e5e17", "object_relation": "md5", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518776, "uuid": "b57d79b8-ca75-48e1-a334-78eafe859bdb", "comment": "Malware payload", "value": "a8e2b38c576bf19f6b0bed69c85c2a64445337087257cf566388f7b0d6d583a3", "object_relation": "sha256", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518776, "uuid": "bed7daff-f0d6-4cc2-ab49-f677e51e1629", "comment": "Malware payload", "value": "e5d152281a61be6db5f3d8d42d985210c4faf283", "object_relation": "sha1", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518776, "uuid": "74d35dfb-4bf9-4420-99ff-c8bac439abe1", "comment": "Malware payload", "value": "c42d461fded15b155e892e828a8713f7e322c115887d2df71bc3aab47c1d109cd78ad96983defe6265f988a9d4ebb21f", "object_relation": "sha3-384", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518776, "uuid": "82764d03-baea-4b63-98ae-e2d76a093412", "value": "T1AD44020277C564BEC75101302FAE3B8EE6B8A53964BDAA09FF94075D7A70453821BE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518776, "uuid": "ef946dbe-3a60-497d-9a88-e67b3770cff4", "value": "3c98c11017e670673be70ad841ea9c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518776, "uuid": "35b8e495-7ac2-46ed-b6da-019ffed30bc5", "value": "6144:yz+92mhAMJ/cPl3ieBLVcFtRbUN5T+ZjOEGdjPrZ17jsjnvlmVe:yK2mhAMJ/cPlfcFnU6kdZonvYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518776, "uuid": "2a3dba9b-8c50-4fa2-991a-c248db4e234d", "value": 273638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518776, "uuid": "68699369-401b-4574-a0a6-4eca69927cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518776, "uuid": "07ad3166-e12a-4130-92a6-915bfb8e75b4", "value": "a8e2b38c576bf19f6b0bed69c85c2a64445337087257cf566388f7b0d6d583a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2091feeb-93d9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645532130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532130, "uuid": "22af1aba-b4c3-4a0b-a0c5-28ee3c0aa55d", "comment": "Malware payload", "value": "6414e94a3259e8d8e133aca4ad148a59", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532130, "uuid": "6ab1f791-31d0-4681-9bf7-e6033f8baffa", "comment": "Malware payload", "value": "a93e23b463cd782647a7ad565873a78b4e9c287503fcb4865bc38da97e754d2c", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532130, "uuid": "1505bc0d-3681-41be-a667-eed8fdaa157e", "comment": "Malware payload", "value": "bce2367b1c8f27ca6fe5847f51695982466c739e", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532130, "uuid": "f4ca6c4f-d6ed-4cbc-9b18-84d89c3bcb34", "comment": "Malware payload", "value": "215db744f707edf6520fed3c3e0705e552d21de8017a9ad9df7a16523e0f0952de83606829f648584fe4b884dda50507", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532130, "uuid": "55265500-3091-41e3-af29-f2e04f47733b", "value": "T14381D6AE034FD9FCF217AD8885D45A47EBB58626462CE6C5CFB0BEEA240147CD0F1498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532130, "uuid": "8f2421d2-17de-4a47-885a-0f3ea22c51c3", "value": "96:UAvd81J/IcNhzLofqz/iL9LD+WTJxkcoTMIZtq5FxFgF+8:Uyd88czoSe9vrTJx1eq57FD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532130, "uuid": "33d0c3dd-1faa-4841-991f-14aed2f91189", "value": 4034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532130, "uuid": "15d61ff1-93d2-4f23-8e0d-d465bcbd5113", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532130, "uuid": "2dd9cf58-9767-4a73-9470-a8c4d06c3b97", "value": "documentaz_801.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecad6a0-93fa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645546596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546596, "uuid": "5164af01-8de6-4557-8b4a-5888f5c0977d", "comment": "Malware payload", "value": "747c457115c2a050f5b1fbc5368350e8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546596, "uuid": "90dfd214-a895-4e45-8543-d012bda56b9d", "comment": "Malware payload", "value": "a9da6676da7df015154e765824ab05f5f43f2e2844e43e0aaf5120f140c84dc5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546596, "uuid": "5f46aeb8-cd56-45aa-80fb-8609f82f3d19", "comment": "Malware payload", "value": "e8fbe829f3bab6f9fd3f3838da8aec1141fe4113", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546596, "uuid": "a1dbb10a-fd68-4b62-876f-e2ba28f117e1", "comment": "Malware payload", "value": "d5692b6356a42cbdab7f6f1f86bfcb51021974619eeb1d8a3377e6dbd08e6f42b0f0e0915bb8f38b8d5b6cd55eee4659", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546596, "uuid": "6e27c8c5-587a-42d7-a9f4-144eabfc8190", "value": "T1F965E146B7C4FC1FCC7380364BBA8A6A95468C468646C71759B4B62C9EFBEC04E45FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546596, "uuid": "85bc546b-794f-4e1f-a00f-79ea13060bb5", "value": "24576:VeCk6ovnguRvVIy46dR2FdWOf+Mn3L3ePq920qslPcrxAjM9EzgvtWR7f:YCUxRvB46dRiAziLuS9jqsZCAjbzgvtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546596, "uuid": "46329224-6f87-4f89-a33d-04acd8500411", "value": 1494130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546596, "uuid": "204d03fc-f2e4-4bce-9e10-53a6cfb40099", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546596, "uuid": "95e3a1db-d1dc-4a9c-9b70-ed72f43f76cc", "value": "poba.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58b1050-93d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531091, "uuid": "aaa6522e-5646-4103-9476-d39ca6adbb5d", "comment": "Malware payload (Mirai)", "value": "3ac275bb421f551d3ab2a5c20352795c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531091, "uuid": "ad3bcafc-af15-403e-86c7-e8b538964c75", "comment": "Malware payload (Mirai)", "value": "aa39c06ab88b04a76d441bc51a2b6f53b373d194cd3a12566a4fc9ad90ad8255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531091, "uuid": "f6fadc9b-b002-4a38-82cf-5b0e5450ac35", "comment": "Malware payload (Mirai)", "value": "ccb89126d44dd136a469d43fe1252787d726cf4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531091, "uuid": "33f9d983-424a-4b17-b27e-825bae4a2754", "comment": "Malware payload (Mirai)", "value": "e4528782a55200f1ceb18bc82d45ad1d6007ee87a18db2d9595aa1fedb72fb72e24a6817233e28f2bfee443ed559b50e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531091, "uuid": "054095cf-abe5-4db6-bd7b-0b2577a9eeb6", "value": "T1C7F46B26B2F330FCD567C03143ABDAA27935F47601226EBB21C4D5352D56EB02B19BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531091, "uuid": "4c601fdf-9796-42b8-b5c7-27fbfc556377", "value": "12288:YcI/ANYTdf0wAJnnuIeC4JKityLEKMcJd:YcIZZfenuIeC4JA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531091, "uuid": "8ec6fc68-4511-44b5-8a5a-4f98e8f6578d", "value": 787296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531091, "uuid": "a0e570d9-dd8d-4866-94dd-dba92cab233f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531091, "uuid": "5c249c26-8a2d-4978-b3e4-b6255c7b6c93", "value": "tester", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63ee2ca-9431-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645570284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645570284, "uuid": "60ca740d-feaa-41d1-aa46-3b213195d24f", "comment": "Malware payload (Loki)", "value": "8f3f4f7a3494f0994cfdb79022c4dbc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645570284, "uuid": "2c9d8d46-94e7-4003-8046-d900e01a5900", "comment": "Malware payload (Loki)", "value": "aa868d4c83469463065c50b61cd3e6cd1d42cc404c2b36cfafdd93f322833975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645570284, "uuid": "024a5f3b-a4b6-4c68-b932-6ba750c2c7fa", "comment": "Malware payload (Loki)", "value": "65a1aa87b9b2337a58d8e722783f6cedc462101f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645570284, "uuid": "067c7217-b85c-48ab-85ce-583a10cac831", "comment": "Malware payload (Loki)", "value": "34175031da3546d31d3f4067463aa4bb70d2b3da6e7fe9c77861734ab828b5a8cd0de4cfd20f86a7d0cf711eda645f12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645570284, "uuid": "cc15d35a-a5c9-4b58-bf0c-1361c4576f63", "value": "T176F49E1631EF9452C362E6B24FD9ACBF87AEF977210B753A308537468732A409D42379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645570284, "uuid": "ec6c7b10-b026-489f-85ad-147bf7f6df8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645570284, "uuid": "0e86eb5f-99b5-4de8-9c09-8619951d4f39", "value": "12288:1RpfjG5Vkobktf918j5v7LhF3ffLJ0CdX8+SAOiaSWUZYkeblu9Q1lWnwdI:1RpbX38lv3hd34PANW/bluEWns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645570284, "uuid": "de05aa87-cddf-4230-8e10-b19eebb3ec79", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645570284, "uuid": "46a8347e-2c7d-4f97-b79f-757790f0d148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645570284, "uuid": "1e366a08-630f-44e2-a817-e33d8d9aabbe", "value": "8f3f4f7a3494f0994cfdb79022c4dbc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6bd0fc-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528180, "uuid": "61ab24f3-1b94-4f2c-8de1-5d7f64d6d8d7", "comment": "Malware payload (Mirai)", "value": "f6120bcc03faa81b94f52773051e1518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528180, "uuid": "8c49cc0b-8e2e-4356-9969-52911a9e8132", "comment": "Malware payload (Mirai)", "value": "aa95d1d72d39262b495dc31e0e180703a16738fa452defca7f244891ef15c3f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528180, "uuid": "e30edd98-46ba-42e6-87fb-0e796fb6a634", "comment": "Malware payload (Mirai)", "value": "8af066b27535452a4b5ecca65a5553ccfbe5d16b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528180, "uuid": "36651de6-aeeb-4a4c-b787-7275604d0f1d", "comment": "Malware payload (Mirai)", "value": "fc62450219af7b1bff8ec2e61d7efe51580cc73632021a3bbd7011972c3a4d1377b5b62a1d677672a8cde549ef238982", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528180, "uuid": "521edebd-1ff5-4b4f-9e7f-de4920e38860", "value": "T1603318D6B401AEBCF95BDFBE80124909FA61620251930B3B737BFD936C322A58D52D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528180, "uuid": "af8b2a46-86e2-40f4-b9b3-de9bc008fd75", "value": "1536:UutWMN1Xt/lsFGaVVjL4sCH/nmiPKV45TdX8o:U0XlOGE4sAfE45pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528180, "uuid": "7d99d401-fde5-4e61-9083-972b9d131229", "value": 52504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528180, "uuid": "7290e28c-dff8-4be6-9319-2b819d297abd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528180, "uuid": "46213859-fe65-4263-913b-69a749c434de", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea57e2b-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645517255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517255, "uuid": "7c3847b9-0f00-41e6-a220-07a59873571c", "comment": "Malware payload (Formbook)", "value": "448027ac61130d2e4d6db71e3bfbc888", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517255, "uuid": "37be74dd-a133-409a-8c79-a536072adf78", "comment": "Malware payload (Formbook)", "value": "ab12ca2a034e07fbdd6c9d6c31270f52173cd8559e12aad0aea593cc460867cd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517255, "uuid": "27c35fbc-b9fb-4347-ae3a-a1286520dc53", "comment": "Malware payload (Formbook)", "value": "2119989b539ebe1cfcdac7a1d20672e7bf8f4415", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517255, "uuid": "99de2354-c965-4cef-aee9-a68681224d6e", "comment": "Malware payload (Formbook)", "value": "2dfea8f0d5b51205437150750af300a7c4ccf8b9c9943346844cf090dd932f76e9467bdb5c7dcf48d24bda5f9a71a266", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517255, "uuid": "34b91ce5-6fe8-4581-897a-ba908c1ee796", "value": "T10C912907E2FCB0A3C0AA9A74118D0191EEC2D8707B7B5FC70EC596177AA69626D20FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517255, "uuid": "87901614-d3f3-4dc9-b050-09e477d763b0", "value": "48:Zvt1FVUT7IzKFG35odeKWd2zPmCY458tpj9/vey+WreTdm0lgKoJgUQ2:Z1FQ7eoeKZz+sopjhve6rvEBoJ7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517255, "uuid": "c8d4fc06-718a-474d-9090-61d077081b60", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517255, "uuid": "dbe7c9eb-3d03-464c-9f40-ae5342368453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517255, "uuid": "d0b3fdb9-7431-4a07-8846-9197f1c9549d", "value": "ARCO Purchase Requisition NO. REQ-05426.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80df9bab-93f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645542600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542600, "uuid": "585dcc67-d02b-4158-b9a1-7ca8b34dccaf", "comment": "Malware payload (Formbook)", "value": "c8639fbf5154fa95384457ccd4767079", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542600, "uuid": "163f2c79-abab-4307-892a-14573900455e", "comment": "Malware payload (Formbook)", "value": "ab4a7ca60231225fa0f0424c92a7e09fe6f096336fe9aa034c84be5c1e81c81a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542600, "uuid": "78fd2416-cd01-4bf4-9d7d-06a613082777", "comment": "Malware payload (Formbook)", "value": "9e4fb6b57f105c48f67bbd3b9a04208a91563e7b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645542600, "uuid": "160b64ca-060c-4546-bf56-bc9d4a173232", "comment": "Malware payload (Formbook)", "value": "50fcf8cd7c83c29d845a8e34dc9475bce892f56632fe6e766223106e6f2181c6aaa22b3a3411c7dd2ce87297ffe58275", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542600, "uuid": "95f25087-fdc9-45e1-8682-ad0bb0a6d6b2", "value": "T1DB954992D15045E6EC684F71A43B0C7106A77EBEFDB4B05E69ACF1752BB32D3002A91B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542600, "uuid": "9b73e718-e393-451e-b1aa-5a4790a456aa", "value": "24576:RveSW0YpX/7JjcwZEveSW0YpX/7JjcwZ:Rv3W0GXDJjvZEv3W0GXDJjvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645542600, "uuid": "e55bfe94-e58b-48fa-8660-fe4e4cbed8c1", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645542600, "uuid": "e9fc103f-e1ec-4cee-b69c-e047a60bbc09", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645542600, "uuid": "d40fa405-025a-4900-9054-9a0797bdbd19", "value": "HSBC Priority Payment Advice HSBC107200191055.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c5f10f-93c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645523925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523925, "uuid": "f0c08a21-ca75-4e01-a699-3bf7357a42b6", "comment": "Malware payload (Formbook)", "value": "0bccae23b7db4cc1a5d6aa9e183c12ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523925, "uuid": "32ac7068-57fb-4005-ba9e-9af4098f3776", "comment": "Malware payload (Formbook)", "value": "acf40f9d3eea74324291c55f5ab8d3678e0dcc085581bdd9cf66897f4324bc3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523925, "uuid": "ba6074e9-ad85-4f93-9c34-94b7c4aaf15d", "comment": "Malware payload (Formbook)", "value": "dfe4e3f489407a0e74a4c39ace73c92b769cc9a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523925, "uuid": "153fa846-d78d-4063-aa93-83e420aac290", "comment": "Malware payload (Formbook)", "value": "54798c751067d6b416935b504827b586a58b317dbc562e5246a3f0a81db51812be25744741f33f4e7d9da362eb252c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523925, "uuid": "a549fbfa-0496-45b8-9e0d-f6bb46514433", "value": "T1969427E3A3C52894C42F027D75EA2D34A3176BAD513149CB0D662E96758F387A363F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523925, "uuid": "8755aa00-b886-44fe-a795-65be5c8372c3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523925, "uuid": "e99389c1-70d2-4062-92e1-47c393b84586", "value": "12288:PpjpU5bfxYvPYvKItfFo8rfhnog3KCb/H4B4qamR8:hjS5bfxYvPYvKItto8rfhnj5jH4BlR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645523925, "uuid": "cddbe99b-33f1-4c8f-ab2e-66cd603d8166", "value": 422970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645523925, "uuid": "94d0d00b-6b22-40f2-b838-eddb0f4de18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523925, "uuid": "234628fc-db71-42f0-8f96-ace33987f62f", "value": "IMG_105509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df6eba3-9407-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645551990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551990, "uuid": "424cc2ab-cf62-4582-8d0f-733df46b7336", "comment": "Malware payload (Smoke Loader)", "value": "bf6d16644fd75fc2998358a95dffface", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551990, "uuid": "810fa223-3b9c-4cd0-8434-79cb6cd93562", "comment": "Malware payload (Smoke Loader)", "value": "acf84eb0e00079cf0b3601554ebd3d31b3b1b73ea212c4ac55a1d715c72759cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551990, "uuid": "921f6378-8760-42f3-8d32-7ab1f297ed1e", "comment": "Malware payload (Smoke Loader)", "value": "e2d530ef0eaf32deee0be90bf17f4b436a815f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551990, "uuid": "468f3c3a-fefb-4fcd-9c08-ce2b06af8883", "comment": "Malware payload (Smoke Loader)", "value": "79e86c51b29ec26599b0024431a30214695164fb47e24eeef63f2cfd200188c249c823f3fca918fa42931b861aeba07f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551990, "uuid": "fe058666-b5a7-43fe-9dca-6c1b32fc88bd", "value": "T191649E10BBA0C435F8B711F446B6A36DB92E7EA16B2490CF12D41AEE86346E1FD31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551990, "uuid": "e735c991-b6db-4eba-ac96-6d8c3c58702b", "value": "5e94baab68b90958add222dbac71061b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551990, "uuid": "69b6913f-6d3b-4d23-9aff-555439caaee6", "value": "6144:bwCiQzZ3Gml5Rqn2aEyunmuPdMWVH47T+zJ5bmm:b/dFtG2UK1PRHw+z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551990, "uuid": "0073cfb9-bc49-48b2-af18-3f1ef1303e55", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551990, "uuid": "0c3f1a19-e6b3-42e7-9b7d-517d1e1f0519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551990, "uuid": "a9a10836-9e8a-49f5-abb4-fd9a8baa5cef", "value": "ACF84EB0E00079CF0B3601554EBD3D31B3B1B73EA212C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145f5879-9434-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645571194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645571194, "uuid": "9544bac2-39a9-4fdb-9209-c3614f58b8de", "comment": "Malware payload (Heodo)", "value": "e0dcd2779ce832066af859d0437fb635", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645571194, "uuid": "fcebae55-2896-4349-b3e6-ac43fca9595c", "comment": "Malware payload (Heodo)", "value": "ad8a5a71124d0c62bf326713c2049aacdd0ea57e2a7dd65574f47fdeab32ffde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645571194, "uuid": "bcd6ea14-1b82-4321-9ced-3dae40ec12c9", "comment": "Malware payload (Heodo)", "value": "d3fb97636214e489688eab0b62665990887317c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645571194, "uuid": "3051361f-03e9-4b70-bdd6-495b8598f64e", "comment": "Malware payload (Heodo)", "value": "7be068417952b257824c94f3e4c0de33af3de5c56e7c478ef3ba985f6ac880c3a6fefc175328d155115ca9b4f92de333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645571194, "uuid": "996a96b6-9184-43a3-9075-464c53aabb92", "value": "T1BFB42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645571194, "uuid": "75436e07-6116-4e6f-b10d-328db60b245e", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645571194, "uuid": "1bcfa250-ac19-472b-a7cc-3397e24c721e", "value": "12288:IOzyEtBX2ZHq79+x6/G5YgvmgZDa6A9TU:lnmZKR+7Yzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645571194, "uuid": "dd11886d-570f-44f0-9f2a-09d77cfa995e", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645571194, "uuid": "e91cb5d8-8944-4c6d-9dd1-3852a8413242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645571194, "uuid": "2698cd3e-216d-4f52-9f69-0004b89ff255", "value": "e0dcd2779ce832066af859d0437fb635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4314d866-93ea-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645539489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539489, "uuid": "a1a7e93a-0ffa-4faf-a1cc-817d3de46c75", "comment": "Malware payload (AgentTesla)", "value": "942e54658c5e0784475c13731befb741", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539489, "uuid": "37f0ea70-5639-4cc1-b27e-dfe9481d4c9b", "comment": "Malware payload (AgentTesla)", "value": "ad8fceae576876cc8e190523038a55e0424875433b9b3cce200c2803c5b0d022", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539489, "uuid": "d472a851-34b8-4397-9399-b919c06ae387", "comment": "Malware payload (AgentTesla)", "value": "7828968979b2fcc41938fba58daff6a8631aeb71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539489, "uuid": "2613182d-5f55-4e41-804d-b0d59b57ffb0", "comment": "Malware payload (AgentTesla)", "value": "4c8aadde203617e1709eb7d61bb18b708d5795933bdb863c8ea8c66c4ae4ba1658c6866c5928644990a9372ea8f25c13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539489, "uuid": "a0f110df-2f97-4755-8db0-25246946932d", "value": "T173355B9C365072EFC85BC976DAA81C64EA60747B930FD203A05712ED9E0DA9BDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539489, "uuid": "b4f40278-b69b-4239-b887-d269cbb3d157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539489, "uuid": "f0240e87-1562-4aff-aec2-72f813648818", "value": "12288:2KjA5orGxxB5v7NKgcUse81U8VQ/X8l2qgK0Lve+qeRSJKwPK7E+slqRzZLQYpUU:jjPr+v7FKei6PjqL8ve+qcSJ8ohEJQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539489, "uuid": "0675b606-e08f-4d7f-8520-5dd3db43d7a1", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539489, "uuid": "d9775008-2498-4d20-9fc3-b2ed2891b1e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539489, "uuid": "180d758d-e2a6-4903-ab18-6497b60c9b34", "value": "Purchased Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d75794-942a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645567004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "ff2dd853-7b88-4842-b5ce-5f1e55a00a08", "comment": "Malware payload (Heodo)", "value": "f9b4e4c4593660ff0695ba88b6a986c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "f50add64-c2fa-446f-b990-142ce51c336f", "comment": "Malware payload (Heodo)", "value": "ae315d41a9794a122be329e6440af7109949e4119f1d250c9b1d7e9653a1d7a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "443d2b30-e1c5-4c18-8b95-079b597779a0", "comment": "Malware payload (Heodo)", "value": "ea467580ae3dca3095e316be8ab9e5f5a38aee48", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "9c757732-c3fd-48a8-b049-743c36953c7f", "comment": "Malware payload (Heodo)", "value": "337cccd6c52d10196275e501fb1c6d4a8935642b22ed33533752a16f00e8e39e6054ee07a74a65e327242554cff2541d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "c690befc-10dd-4221-9c4d-6eb679d43fac", "value": "T1FEB42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "aa917d41-c64a-403f-a492-19e61ab222f7", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "89ea9996-20f6-4f7a-9f0e-5bfcff6835d8", "value": "12288:IOzyEtBX2ZHq79+26/G5YgvmgZDa6A9TU:lnmZKR+WYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645567004, "uuid": "44448cd6-aa09-4de3-8dc1-2f286269d4b2", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645567004, "uuid": "f515cb65-d69d-4719-ac0e-69346466ece9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "08a65ae1-42b7-445b-93cb-b3b85ca6b78b", "value": "emotet_exe_e4_ae315d41a9794a122be329e6440af7109949e4119f1d250c9b1d7e9653a1d7a0_2022-02-22__215639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93249fc-940f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555579, "uuid": "85eb5b4f-6a73-406f-993d-6e66f0d8b266", "comment": "Malware payload", "value": "603d2d0b524a257e8ea5d5ee4278d1fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555579, "uuid": "d91b89f5-a54a-4b34-901d-af2c70789c72", "comment": "Malware payload", "value": "ae5dfa32133a5148eaa60fffc31861cb92ed7f31636e6c21e7bbf3fc4261ade8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555579, "uuid": "78db25dd-6ce2-4b93-b836-694b6dfc662b", "comment": "Malware payload", "value": "27e333346c130dca6bd2c3c2859399b324087f7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555579, "uuid": "4ea78706-b5a6-43b6-8c21-59117625d6b3", "comment": "Malware payload", "value": "fb8094b524b1a17f60a8cb53f8c6644abb357f1be3843684b45ac15cfdd2aaf2dd772350233fca83a0df7bab9d32198b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555579, "uuid": "482e18ba-a74c-4bc4-a52b-34c1691c3cd4", "value": "T1B1C163A2DBB9111F275B89C1712A85F3EF9EF64807CDF9CA48291E05440BA2F70A0D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555579, "uuid": "d803e827-a5aa-4b82-bb10-87f237be6398", "value": "96:RxNpTEVZ2iowT6EZPo7tjtTiUN14cD8LkH:RxNBNwTwDiopckH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555579, "uuid": "6169c5d7-456c-4442-8662-ea7d0f7221ee", "value": 6025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555579, "uuid": "67cf2b49-fb95-4400-9655-460055562f6a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555579, "uuid": "a48db591-b2c7-4e9a-9114-bde887051db1", "value": "Bt0CmBR6dVoWhbYd0MysWuV5LKOmpypn8E01oi16ES4qOo3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60cc1c6-93a7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645510906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510906, "uuid": "6871c6ea-1a7c-4e92-bbae-6835d421a7d9", "comment": "Malware payload (AgentTesla)", "value": "d1eba45d960b9f11355b1b56033b4a91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510906, "uuid": "139abf3b-647e-401f-b7ac-f4b4e41002df", "comment": "Malware payload (AgentTesla)", "value": "ae77035198cc2bf32a90a181c8bcb7cdc1159a14a086efc89aeb5ffffcd79747", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510906, "uuid": "b89e479d-4fc4-4abe-bf19-ed789fbcbc1f", "comment": "Malware payload (AgentTesla)", "value": "dc2420168ec70de606797f2b98d71e6c16f8f278", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510906, "uuid": "62d8d645-c258-4704-9aad-cc15cddf4c5b", "comment": "Malware payload (AgentTesla)", "value": "91d3384332293fe7b1828a958bdebb76b829ef4c81cba9cc263b6030c767d93dac1e6d433b359c1a7b0c72d5fbc86279", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510906, "uuid": "2f875cf4-5558-4aec-a9aa-25ef4746d09f", "value": "T1A0F4230D0A320CE139362355E741BD86F638889CCB55D36DEE61476A7648B60CB3DBBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510906, "uuid": "b85f4877-32d9-44f9-8da9-890fc977d966", "value": "12288:eepcs3qiVro/nLBOpkCgOljSYSgCQ2MzhO3Ya8SE5d3QD1d:LpckcnLBp9SSG52MzaYapE5d3QDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645510906, "uuid": "6e30b007-5668-4c3d-96a5-71194a96a9ba", "value": 728636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645510906, "uuid": "8fa651fd-05c3-4cc6-959f-08fe7d8ee8d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510906, "uuid": "836c842a-d6cf-4bcd-a466-366e842c22b4", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cd79c4-9406-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645551463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551463, "uuid": "53c459c0-d00f-4a33-851c-a6ee2002d6a1", "comment": "Malware payload (RedLineStealer)", "value": "ccb46ec8b94986c195b87da5281f4c67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551463, "uuid": "49b07d6e-4e86-43d7-8880-a8780eeadeb4", "comment": "Malware payload (RedLineStealer)", "value": "af10cbbe50cbf0bd3435b33c0a87dc8f6c6840179237b14137a4c3c97f74cd49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551463, "uuid": "0e09c83e-6a97-4105-b7c6-9adf4cb9e120", "comment": "Malware payload (RedLineStealer)", "value": "1f2f834aa75870ddf5e843f4d70bbf1d92446da3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551463, "uuid": "e8322b12-6858-447b-9f36-bf255ca6726a", "comment": "Malware payload (RedLineStealer)", "value": "ad80a9efd28b064bff968c928245b82d104d3aceefe584646bc8d054d0c2b43e5e2ed5ff37f37520c172f08563848b95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551463, "uuid": "65243af8-73e5-48e7-a375-90c9138cfac9", "value": "T1690512C2B3A8D05ACA5695B92333451283ADCE01613DCB0F74E6746EA8FF3522563F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551463, "uuid": "7770c940-bae8-448b-8bd9-42a168c208fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551463, "uuid": "9befa498-a87a-4db5-89c2-1080726e2c75", "value": "12288:yu33qzmE0oTG36EDgUfmqXt7zvwf9TGPKbLH/YUJIKc31aZi09:j33jE0MGRMUrdPv1KP7Jv6V09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551463, "uuid": "019bee38-5419-4a9e-917d-ece130870668", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551463, "uuid": "5f4f9d68-1660-4273-b938-6821ebcddf95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551463, "uuid": "5490ba1a-b02b-48a7-8419-7fd046e1e8dc", "value": "ccb46ec8b94986c195b87da5281f4c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fe5c13-9402-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645550104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550104, "uuid": "d92e3b52-2345-47b8-afa2-6b9e090e9e60", "comment": "Malware payload", "value": "ff8d0e486229d73c3ba577b163a9c22c", "object_relation": "md5", "Tag": [ { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550104, "uuid": "adafa714-e1ba-4b32-8e13-603236afc314", "comment": "Malware payload", "value": "af4943426ea53ea89170f601f5a4015ed0fe46192f4bb61c7018c6967729c491", "object_relation": "sha256", "Tag": [ { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550104, "uuid": "9d8deb4e-ee61-4927-8752-8494cbee1938", "comment": "Malware payload", "value": "fd91023921648acf4d747bb11d40d84c41f952ee", "object_relation": "sha1", "Tag": [ { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550104, "uuid": "ed21e8b6-fe71-48b8-a1de-7e3c7f22c3ed", "comment": "Malware payload", "value": "66b534808664d2b96ceffd0fcefb0f8f6ea8c96f3c4a34fdcf3b8a325ab584006677354a45fa6af3aeaddb4840da8c59", "object_relation": "sha3-384", "Tag": [ { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550104, "uuid": "fdd80d96-6697-48ea-bcf2-ee1022c78569", "value": "T14AD3027E588E313D8C8BC30A794976414F7DD0B83A4529501E7C0AD29784FA1F4BBBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550104, "uuid": "98e3af81-0520-4d9a-a650-09a43ed7d2e5", "value": "3072:OO+lJ/wSLhlp4IxtDA5Xer0CpxLU53zGsbeYN5jvVMyL0:OOgJ/nL14KVA5Xer0Cc53zGeXNXMs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550104, "uuid": "0d5a1162-02e6-4480-87f3-0276258333bf", "value": 137067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550104, "uuid": "7378113f-25a6-408f-b542-af8fda93797c", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550104, "uuid": "3c4e930d-502f-4eff-8a5f-f03a20c0d64a", "value": "RISPONDA PER FAVORE.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b521ac-941c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645561103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561103, "uuid": "1dfc332e-85ce-41b1-8a56-41fce5ecb7a0", "comment": "Malware payload (Formbook)", "value": "7ad92f32cf9a161c65d22711297b8356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561103, "uuid": "17914649-b9eb-44dc-b862-ddc828193096", "comment": "Malware payload (Formbook)", "value": "afbdd9ab054b366c704062a6c9270398f6b51e02d3678e9595ed13b5561f7278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561103, "uuid": "6bedb4d9-7365-4ee1-9287-bdb6c9ea11ea", "comment": "Malware payload (Formbook)", "value": "e43b4cf3c664766020ebb289baf5ebcec7a40cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645561103, "uuid": "f528bf7d-8863-4ee2-84f6-bdc18d54527c", "comment": "Malware payload (Formbook)", "value": "8189da77b5cfbedcffa2d8df37116385cb0a229e003103d29f85b5bea04ae6a0c95ed4ec50ea31bc817885b68cdde649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561103, "uuid": "591bbef5-21ae-439b-8cdf-681369e5c2ac", "value": "T1BD3413AF18D88996D7851D75816757BBE7FEA3043240048FDF2C2E7F5CA5243240A75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561103, "uuid": "909b77ef-c66d-4f35-8df7-e7ad2c9ad579", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561103, "uuid": "70b36f2c-96b6-4382-a19f-4ac47ce4a83d", "value": "3072:Tx6UW6tpmJcMv/5G1UXiv1sUaYQk3JQ1rJJjfZzB4xWD7LrmI6i395/uqgXZNBQZ:TxDe5G1seaTi+rJok66KqgXDNpfqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645561103, "uuid": "60a857e5-d67d-412a-af06-1b90d5f132ef", "value": 245603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645561103, "uuid": "43884469-f7d9-47f3-88ce-4b794bc10ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645561103, "uuid": "fb958afb-5e11-4ded-bcd0-92b6d8d1c74b", "value": "PO787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90d7682-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492094, "uuid": "3223a9ca-4955-4119-bad1-d6a346f438f4", "comment": "Malware payload (Mirai)", "value": "72267f39b1a2d73f372317a791215ef5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492094, "uuid": "3441ebc8-825a-4ac7-8799-5be54fab471f", "comment": "Malware payload (Mirai)", "value": "b0167e3f033931c21b9072bd417efa04be1686b9119948eb835e1306d928e2c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492094, "uuid": "df175bf3-190e-441f-9637-58d8975a7ce4", "comment": "Malware payload (Mirai)", "value": "18dcc20b15e22a1d87d80eb7a65dc99e912da3ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492094, "uuid": "c02d90fb-4b8d-4cb0-ae45-8af68f46651c", "comment": "Malware payload (Mirai)", "value": "19e02666bce9cbbaec2b07bc32074a0ab0b203a6a555e5a35c105d44f6d903dff8e8907ac5371b53be0b728b1ef47d78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492094, "uuid": "87fb2747-04fc-417a-ac8a-831103487d6a", "value": "T1ADE2F10EBE9CDC05EF5A6372E10C4EDD7E320C652717EAD0328CD15B4F2A0B056E9256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492094, "uuid": "b833bdb9-a245-42a8-863a-18abee50bd5f", "value": "384:MSjLwqHgRFSchC6Id/Jpz/fq/dMkoDimWb4TzDxNxszhug/yAV79tIDOmHkxm+us:3OKDImFTd5gVV7MDOmHY+020KU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492094, "uuid": "e886b2ec-b082-4a93-ae33-eaf6e32a6617", "value": 32152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492094, "uuid": "f94a9831-4543-4f09-8374-39d90836b0b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492094, "uuid": "938735b9-034e-43e1-ad25-7b4637d3a82d", "value": "72267f39b1a2d73f372317a791215ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3605dc69-93e7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645538179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538179, "uuid": "200c6f87-0fc5-4f5a-ab5f-48be64df92ff", "comment": "Malware payload", "value": "cab943b2bcdb2c8b975e68892af14175", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538179, "uuid": "b9529aa2-adf5-4418-804b-86dcf0811853", "comment": "Malware payload", "value": "b028c8f0e5b6aec13e0acf85cb5cb33755d411e0356fcb6b836a94d6c414e214", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538179, "uuid": "16d5120c-bde3-4db3-86f1-920fe97304d0", "comment": "Malware payload", "value": "acfce587a94fbf0b3c91afa10407180466332c97", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538179, "uuid": "06e6edaa-9422-40b4-b341-ae3ca863b623", "comment": "Malware payload", "value": "82a8279613df3982423dd62c7448ef519692c9b95e74ea9737aa0af66d0ad5cc589d2f7e5af6ce25644f0327d23977b2", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538179, "uuid": "b214bff5-0b39-4059-8ab4-57929b235f5e", "value": "T1192423113AA8CDE9C3A9376E30693F91E6F13FCC120C065673952C26853E4A7F4A85D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538179, "uuid": "12c3f741-a984-4d12-bd07-d6f9a6b47fad", "value": "6144:ePiTxPi6Sp1jroof4G0GAG5MRNMBdz4+sh65VWRe4:eM/IPolG0G35MDMBlMQw04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645538179, "uuid": "645456b4-1637-41a2-8ba1-61d3b6733258", "value": 218157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645538179, "uuid": "33eedeee-4798-44b3-a2a9-e43a7125f6d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538179, "uuid": "c9bb414d-6766-40af-b08c-02d13acc04e5", "value": "neraateedepbfeirs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9284e9f1-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645514282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514282, "uuid": "4f18e990-2889-4418-bbfc-3d4382e76b01", "comment": "Malware payload (Loki)", "value": "c5173aad81fa8b5c3267e9319eddbe43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514282, "uuid": "a0254d78-d97f-4a58-b020-6cf000fd4c0e", "comment": "Malware payload (Loki)", "value": "b03e8aef15a28e46401eec5c7ba2cf94a90c492a0c5e6c602c9e2283c0dfda3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514282, "uuid": "d7608adc-1a3d-4c75-85a8-04e00340aa2b", "comment": "Malware payload (Loki)", "value": "4ef8452a3ea96325285ce40afc09a8601ee6e65d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514282, "uuid": "8bbba089-9be0-4d3a-a6ba-456fd2b897ce", "comment": "Malware payload (Loki)", "value": "6d03eb3226252403dc386e4500bcd6c9313adb4dc0aa87f7c050713a542ae615f7e20b0867d0e90a0bdd1f4d82f2d447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514282, "uuid": "ebe5d2b9-a987-41ab-8202-bf1636b5b42c", "value": "T1A7F4BF143AA74F3CF0B94BB659D0EC64B7A8F7231C19F37D7C406296CA92B508D426B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514282, "uuid": "4a6cfd54-682f-4e86-845d-1ff14c95f6d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514282, "uuid": "99f3ae54-0a2e-4239-b804-a25c41cf3ef1", "value": "12288:xgB6PpvNuh7jQqoyRwTR5n4hwNS9BdcBmumBDRnaEx1LVw09T6ZifEv2:9pvNCSXe9jdcBmhkWd22T6Zicv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514282, "uuid": "1a4496ed-646a-408d-9044-4d1ceb71910d", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514282, "uuid": "bbef5f81-320e-4a66-ac10-55324fa0bc21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514282, "uuid": "d1856daf-1792-4bf0-b706-a06d37737ab1", "value": "Swift MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81451ca4-93bd-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645520266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520266, "uuid": "ab949489-2106-4f86-ac38-a7192ac2e185", "comment": "Malware payload (GuLoader)", "value": "effd03e2901029b294359d27f92c9c30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520266, "uuid": "a1fdf8bf-6720-438f-8087-53e302986ca3", "comment": "Malware payload (GuLoader)", "value": "b06251271462b7ef68d0bcc69258642051c9da6d1d5df95c8e3f031a07906388", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520266, "uuid": "8b459edd-a655-456d-b68c-c354b0ae1e42", "comment": "Malware payload (GuLoader)", "value": "9586b111380efa996b4f3e9ec67f75f62632bbb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520266, "uuid": "1a81386e-23aa-4a35-89b6-4ed1d7b3ca30", "comment": "Malware payload (GuLoader)", "value": "5049e596b495feaf6adce0fa8a7d315c3029d7971e5ac4f91c12841172014326c45b8d075035654601583f4b45d32818", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520266, "uuid": "b74a8a49-5503-4d55-888d-258e716ba9d5", "value": "T1B1346B9BF5214875F1E40ABC6862C04252D42C2426D5A76A7CEAFA7CE9314CD7373E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520266, "uuid": "bf1491de-a77a-46a4-bc9d-bd9c01faac7a", "value": "48e807a7b58ea2b8edb6203daf32ec53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520266, "uuid": "7b05ca6c-6dfc-4981-85ca-2e4be634252b", "value": "3072:j0Wum2MgC/3w5/rQmFZFkRmiLT8wQ62oIm2M7Wa:j0fmRgGgRg/p//ImR73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645520266, "uuid": "7dd6372c-086a-455c-8726-30766aaceace", "value": 247504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645520266, "uuid": "345af4fa-1bf1-4a5c-85c1-516113a07c2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520266, "uuid": "c9082eeb-e24a-4e67-9511-014212b62c3d", "value": "effd03e2901029b294359d27f92c9c30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112f1173-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645514495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514495, "uuid": "5b8b5e87-e50d-4595-bc1c-a00ef2fc3039", "comment": "Malware payload (AgentTesla)", "value": "a6794d5f6e3de34459ab9afa154adc09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514495, "uuid": "1baeb58b-b94f-4e3b-b062-e3fe525818d6", "comment": "Malware payload (AgentTesla)", "value": "b0f86c213658d7a0f74cf1de04bf8cfb34ae11bf9097fc5fdefff51a0f2f405a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514495, "uuid": "9556cd5a-1cba-46df-acd5-632ea1afa7a3", "comment": "Malware payload (AgentTesla)", "value": "9fac8c2b038db8c17171cb6d868bed3da17391b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514495, "uuid": "358be018-1224-462d-aba4-97c1d30b2ac6", "comment": "Malware payload (AgentTesla)", "value": "560985c9d8198a69f4a9fff952abe51904ef1a43be31686e1d0bacf71db480c8cd3b11139d2dc7adefc2800488eeb826", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514495, "uuid": "f9ae3ebe-8816-4820-b76f-d9ffe281bd98", "value": "T16014125076F5D932EDB24733D3DC8C24029ACCE7E17AF2069197FEDC1A74844246B6AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514495, "uuid": "678a6455-e098-42cd-a97a-723929f7d90e", "value": "3072:K8liAQM+oEmS5JXbn8sbz8TTnSU7R+HXhbSe8rZklaj7woIe7z+zOL2bfODdAx8r:/liA9+D5Rn8cz8TTnSqYbDguanOVc27K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514495, "uuid": "3852f729-f163-45c9-bb4a-6fa207512806", "value": 191800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514495, "uuid": "e9e23770-3c34-4c8c-b9c2-5bc3aef25a47", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514495, "uuid": "0d7625aa-9268-48e8-b977-1ccf4d3022cd", "value": "Quote request 22.2.2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2f3c04-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531752, "uuid": "b5ae13c9-1fb0-4d15-ab95-c952b13a2fe2", "comment": "Malware payload (Mirai)", "value": "1671e360b25e830a968dcf54f33e3ba7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531752, "uuid": "4befd45d-e8f6-4e78-953e-cea566b9f45f", "comment": "Malware payload (Mirai)", "value": "b137c380571e7c16ec2b256cdc0ba2f45cf0e190c8a1bb40be3a9b7fd2414b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531752, "uuid": "323b70dc-29c2-4d58-8186-d775ab3a90e4", "comment": "Malware payload (Mirai)", "value": "170bc2c0774f6b7d2b31b75bdaf584494eb24f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531752, "uuid": "ab968b05-6174-427d-9ccb-0dec9999c224", "comment": "Malware payload (Mirai)", "value": "96b22549c5b75133e8f84ce2bb412153c7f4e302e74618c9792b9683d0e19d7e407dfe8dd1809672eb6b4e64197f06fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531752, "uuid": "a58da9d3-5e62-4f3e-82f1-7f0dea38c5bb", "value": "T16263079678C19A12C6E423BBF96E01CD332563A8D2DF320B9D212F5477CA82F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531752, "uuid": "b1e49142-7098-41f4-a1ba-576326bb8f1e", "value": "1536:U69Uvb15Wu1S7+hIVt5f6pxCCpRT8PIOcahWMUXH4g5b9/e35uEfh:U6ex9RIIOvhTNgm3nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531752, "uuid": "8a6774d1-a2c6-41fc-a88f-2d31aa069fbb", "value": 72188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531752, "uuid": "84eba683-b00d-4414-bb73-9fe29256b02f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531752, "uuid": "5c3cae02-5038-4665-9a82-a77ebd405622", "value": "vcimanagement.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadd0ea0-93df-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645535073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535073, "uuid": "d0fd11db-8a85-43ec-85ab-7f2305bdcb4e", "comment": "Malware payload (AgentTesla)", "value": "71297326611cb75b384f9807eb368745", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535073, "uuid": "e58196de-ff3b-403b-be3a-0a5ec07d96ec", "comment": "Malware payload (AgentTesla)", "value": "b1a855001169606216bf7cb5a5add5dcadf7c4b8ddce5a5a9fadccb23f318fb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535073, "uuid": "757bcc19-b355-4d2a-a1c9-a3c1fe8bf5bd", "comment": "Malware payload (AgentTesla)", "value": "14aaa8c1308635bd7f7af5ca036363a5cf16246c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535073, "uuid": "e7985448-b913-429d-a7cd-42b21adb6f13", "comment": "Malware payload (AgentTesla)", "value": "d3c3e97f8fa0d57d2502bfef5db4b47007f65bf58516b844a090d4ce1c3449a2a859adc4cedd8ae3383e833074cf68cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535073, "uuid": "49577063-b4b7-4fa6-a626-d6c480b5581a", "value": "T127355A9C365072EFC867C972CAA81C64EA60747B930BD203A05716EDDE0DA9BDF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535073, "uuid": "df5d4bbe-5c00-4019-8c38-f673d0b0486a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535073, "uuid": "89037a9f-d4e6-4b06-8191-691a366fb9c4", "value": "12288:g4R8+tcYaibUaIV88Uaw3fZ8vpPiZt56uxz58OX1JO2JG2C+8fh154m0UvzPBa3+:g4CWB8UPopqUETTG88T6mNvzP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645535073, "uuid": "26f5e49a-56b9-4198-bd7e-6e7b5fb97a59", "value": 1128960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645535073, "uuid": "5f716fd9-bccf-4dbc-b68e-0fad4893865e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535073, "uuid": "3148ef72-7e5a-4833-9f8b-ac432c776108", "value": "AWB #6376485942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f59a68-9418-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645559405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559405, "uuid": "948d83e4-9c8c-44e5-a593-f97d1ed7805a", "comment": "Malware payload (Mirai)", "value": "205da065976f98e3ef78ac16d3d47f75", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559405, "uuid": "bde03ba7-9480-414f-855c-b347f9618793", "comment": "Malware payload (Mirai)", "value": "b1c34c713cf8b5d48317745b174d7c3f7df2a63b9a77662222ec853b36d95c7c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559405, "uuid": "43015e3b-14c6-48fc-86a0-0cbe49c973fb", "comment": "Malware payload (Mirai)", "value": "5b150db04798da9a1df783ac511e34f0f93171e3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559405, "uuid": "7aedf33a-bd27-4d23-83c1-a4a50debb3ce", "comment": "Malware payload (Mirai)", "value": "cc14e4c2dd7878f236a9f4d2e0e60ba521e3b4211bc0ff185745c79d783e0867a0e1a39e3c6f1312aa3d0827855f40e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559405, "uuid": "a8e75fe5-0ada-49c0-92eb-49212343cae0", "value": "T1EC5302309138E4264A203832E5BFC1E57EE0BD38D7ED7C23636656305C7298475B2BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559405, "uuid": "14bd1047-f618-4ac3-92be-bba08219f41a", "value": "1536:UDqNjwIRqdAvuodygdgPg6pTkp+PS0VLeK/J12aZ4uGQ:u+wI0dAx96hPdLegJ174u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559405, "uuid": "f84b3031-2801-49f4-ae35-4b0b395be8fe", "value": 61472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559405, "uuid": "89c7c3d8-c820-4322-84af-1d4240794109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559405, "uuid": "2b20220a-dd79-45e9-b6b6-57b9eeed122b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b2dba6-9375-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645489269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645489269, "uuid": "c5a6aa13-a039-4ca0-9ad3-b53c4f121f32", "comment": "Malware payload (Mirai)", "value": "32c472b46259585433a2163ce01da507", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645489269, "uuid": "74c3a56d-b143-40e7-a598-bdff74776703", "comment": "Malware payload (Mirai)", "value": "b26373c0731f3e12184956686354cf71b1eab1d2c6f461f4b20b49721f0fd469", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645489269, "uuid": "98d71fa0-ff2d-4240-a55e-808b2179717c", "comment": "Malware payload (Mirai)", "value": "d310f9de31dcdbabf68d2dc8490b4edefc914a04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645489269, "uuid": "d4095e12-773d-4ab9-837f-bba0ead16122", "comment": "Malware payload (Mirai)", "value": "d10ce562c1b997bf85d05792fda167fc37fd947387b40538bec663bbb3ed2ee64ec37e8a0c9723938b3df5a051385036", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645489269, "uuid": "e8c3518c-b0cf-4958-8e5e-d39e8b3de730", "value": "T18DF2E11D071D88B6EE7A9CF540691FB127B14FD13941E40DA5E9E7A2CF420B6ACC11DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645489269, "uuid": "fc66edac-a923-4b05-a8de-a9d8dbeb9b03", "value": "768:XXeiEwNXSeha4emu+/RqSVzEvMMLrBveYrk+SjGOVVrwJgGlzDpUYscZ:XX5Nqo3RqSqL0Y4+SPV8VqYlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645489269, "uuid": "0eb0471f-898a-4148-925e-909b2513779e", "value": 35632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645489269, "uuid": "c406fb81-df00-4aaf-9d68-846922431ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645489269, "uuid": "af2abb62-71ed-4a3d-8f4b-677e599679c5", "value": "32c472b46259585433a2163ce01da507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d4a798-93f5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645544385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544385, "uuid": "52b44096-73c1-48cf-b5a2-c9cb7204a01e", "comment": "Malware payload", "value": "951f41c14f3aee39f399be45a2550dd6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544385, "uuid": "67153993-efc1-4bbe-89c6-d3896d6018cf", "comment": "Malware payload", "value": "b27808e387281b78a84d34d5b9a1a1a7c1d5c8b30deacc5e88561c6fc191440a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544385, "uuid": "d71946e1-98d7-4ac6-9b92-9cf7118cdca8", "comment": "Malware payload", "value": "04f9a781fca8b5eaef23dd52f84667e85e709122", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645544385, "uuid": "d318b67c-59e1-440b-be98-7cc67df0a740", "comment": "Malware payload", "value": "5c871835cdbd6d51bd484d6a8f776caf53fb1da91da329914965a574963f648271b6e6ec7831dd3a87ac487d7332b427", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544385, "uuid": "23f9b0ad-2af2-4115-88eb-3c1703a15c9e", "value": "T17195339F332FA218F6C8C6B84891D84BDF057F0BE41E27DC0716D9B550F70A6A72196A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544385, "uuid": "5cd92c86-eed2-4cf7-98c2-95bd241854b4", "value": "49152:kvhk0+E5Rk6yACGxqdYgWPik6MULBuT7+sX6wmGcnVxCt2GscM1/mM:NBEwJWJ63AT7vX67zxCt2bcMwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645544385, "uuid": "b798226d-bf5c-4df2-b17b-e0ee941fb629", "value": 1973732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645544385, "uuid": "aca1f078-6807-4ea5-b35d-520b1e566fe1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645544385, "uuid": "caee0c12-d2e2-4265-bc28-7550673d9379", "value": "be9cm40vk5_Receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16502934-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645503766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503766, "uuid": "cbe59ef9-49f0-4c4b-a31b-8f368e7aa559", "comment": "Malware payload (AgentTesla)", "value": "9457f3eb618ae5343c4d8e195249e371", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503766, "uuid": "310bd8a7-cc5d-4f5e-83a1-81542f88759c", "comment": "Malware payload (AgentTesla)", "value": "b28b7e399bd646956848e34fba2e29f97b5dabcf2b5c2cf69df7ea4fca2e24e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503766, "uuid": "ab489249-c268-415e-9bff-969cbd28a1cd", "comment": "Malware payload (AgentTesla)", "value": "7586e3230afe8e18c1754c54f1b93d597729cb75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503766, "uuid": "55144037-a621-448b-83f6-8202c6893326", "comment": "Malware payload (AgentTesla)", "value": "b28267abc6efb15974e019ee2aa7c1e0e3e00f11e55eb1618f9877c05dd9942e85d3e54d51efc8eede84d867f2bffda5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503766, "uuid": "77d9e236-1ba6-49b2-8fed-bf43e9f35ec9", "value": "T171F47DA513543EDBC5FD19BC62080D01A2FE8E5A6221EF8D3DA230DBD6E3B064747769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503766, "uuid": "5587d38c-0ee9-41df-9ed6-da6d7db7de8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503766, "uuid": "0128790b-0697-4125-bbc3-39c7f8bfd696", "value": "12288:76Pm97KRLngmsc9OGBu5t5kUBdaeJxeRQTR//Jm+ObPugEOfszG5wv:T97wRsR9YeSCTR/hm+Qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503766, "uuid": "568259f9-5100-4cb2-a8ac-e44efb9daf0d", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503766, "uuid": "edb3a221-7a58-4611-a4bf-58ac413bdff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503766, "uuid": "acf19a2f-e71b-482d-91d0-f2945ab74e12", "value": "WI-356-0325 20220210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e40c4af-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503940, "uuid": "bd984521-ebd8-4cfa-b437-6dfae6a0c464", "comment": "Malware payload (Mirai)", "value": "73d21637f6c54b60f5cda84ef9ed7f2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503940, "uuid": "6d2f4bf9-7a7c-4f8a-9539-d4f8ac84f660", "comment": "Malware payload (Mirai)", "value": "b29cf589f058787862f2634ff25d1cbfc6315db96752f114bcc7a4f767845c76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503940, "uuid": "a74a7ba9-f6c8-4286-bb3d-5dbc6d1bb491", "comment": "Malware payload (Mirai)", "value": "68ae1381c77d62c4a5756756636c37c2bcc58849", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503940, "uuid": "c0dbdd34-86d6-4d15-81bd-736f253bb5ad", "comment": "Malware payload (Mirai)", "value": "206000d895c73f595ea8ff98af6e81a70e29a2e6ce4702495bec4706f3a240fa3f8572f0eafdfb08fd686ad79f7cfac0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503940, "uuid": "47a0b4d0-d8f0-460a-abc0-e699293d136a", "value": "T15713F2137A3D99F1C76BCA78A33487476F951439D1E134221BE08960264738AA5FB3F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503940, "uuid": "2ad88809-0a21-4fbc-8be0-c2130b1f7ee2", "value": "768:9N7GeIev3ELqjJJ0xgGXBBjQxTtm2u6lbaW2sZUx2hekZojUyHXs3UozH:3a5ev3ELsYjQxTtJllWW2sZBe0ojUyHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503940, "uuid": "459ef6aa-6487-449c-ac56-ae6ec8928cd8", "value": 41936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503940, "uuid": "f1d6206a-d41f-4809-9170-55e6006d69bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503940, "uuid": "42724791-7ae6-450e-a8ba-c8d10d0c1215", "value": "73d21637f6c54b60f5cda84ef9ed7f2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ab1e5c-9390-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645500733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645500733, "uuid": "940c66df-8409-430b-a90a-63a43f356afe", "comment": "Malware payload (AgentTesla)", "value": "d52d913b207c000747afc8ae66bf1661", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645500733, "uuid": "292ff8e8-23a9-4451-a332-36cf28cd869e", "comment": "Malware payload (AgentTesla)", "value": "b2c821ab9952256f2c01ccc3fca3f0f45bcfa8956eda979a2d47114ab1357968", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645500733, "uuid": "27eefefb-0dcc-4f03-a1a2-fe3671441c6f", "comment": "Malware payload (AgentTesla)", "value": "5d5c535b86757e1dd7ebe6ac7ab4e18adb93c424", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645500733, "uuid": "b896384e-906f-41d4-9b0d-96c8d79c6cfe", "comment": "Malware payload (AgentTesla)", "value": "8c140ed68b69b910380e03fc8cba3bac10127d5c6a17ebe42479bf73d8971ac25fcdb20f55e0b1499b0a1b9ba082538a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645500733, "uuid": "56c3e674-647b-427c-8e83-a000132cd6cd", "value": "T1D015CF143AA75F3DF1B94BB249D1EC64BB69F2235C09F37E7C50158ACA52B018D422B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645500733, "uuid": "8a6a4ab6-5b08-44df-b4bf-a6f1a5085736", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645500733, "uuid": "7929b45e-870d-4d29-b447-e6270e3bc6d1", "value": "12288:ogB6PCNYh7j/LWVppFtp8GMGxK0denax/sNa2OS/3cMWjBXtQPZ3hIlXB:kCNCLWxnpzMGPdzx/A/3iXIZxIlXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645500733, "uuid": "4870adf1-8feb-4737-9baa-fd6ed8f868bb", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645500733, "uuid": "3ee184cf-5b57-42b8-bbd7-246e30a507b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645500733, "uuid": "08c132ed-a5df-4ca5-ba41-221d47e98cbe", "value": "overdue invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419b370c-93c3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645522737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522737, "uuid": "5cba5a30-ea4c-4b05-a7c3-5f533799faf3", "comment": "Malware payload", "value": "7ba6929ac66130a24c32a947616ea57d", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522737, "uuid": "4d7f76bb-e36b-4c49-a9a6-b04f609fadcb", "comment": "Malware payload", "value": "b2e38dcde349a45f7b292878dd74ce57f1885a9f2cc9c0d33a30f1cb78cd6d57", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522737, "uuid": "8a162300-8c6f-4c4b-86bb-10737547e5cf", "comment": "Malware payload", "value": "b9b588d217cb938dfbb7f39d4fcc168ac32cba26", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522737, "uuid": "078c76f3-11b8-436c-9650-f93e670574db", "comment": "Malware payload", "value": "a1c09cda2e213383564e27054d7ab095577728aa9aa76929a7568107454af2db7afb107e5c8e2f72cbcc1a5a54d845b7", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522737, "uuid": "a513d50e-7cfe-4924-81ec-ba983187832d", "value": "T1D381C499074FCAFDF667ACC4C5D95A03EBB58626062CE6C0CF607EFA2504978E4F1858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522737, "uuid": "d37b247e-018b-45dc-ad23-eae102086655", "value": "96:IHqstdfgpN2g2bcl/VRMN8R3kw/PAM+TVZZuSKm8RIFlTajM:Cr2x2bcl/VyqRTTqZYIFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645522737, "uuid": "a387e8de-e333-44f7-8b33-4a49cef2f328", "value": 4149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645522737, "uuid": "7a9c0b40-ea43-4f93-a6aa-fb6861a71806", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522737, "uuid": "06f70094-c49b-4aff-a472-5e72a45ccc3c", "value": "documentaz_819.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0504c1-9413-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1645557386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557386, "uuid": "4ffc41e0-596f-4ca4-b25a-2f5180e42764", "comment": "Malware payload (Pony)", "value": "2942a7163a9f2fbb47d2d9e2e053a56f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557386, "uuid": "1ac86db7-ad99-4d80-9c58-7bde27d6dee8", "comment": "Malware payload (Pony)", "value": "b2e98bd78bdba356d5522333004ef68ce5046b0c5fc36c4f417dea1cfd015571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557386, "uuid": "41b03404-8a78-48b3-a663-2f974a1fdc9b", "comment": "Malware payload (Pony)", "value": "884c7c3e9eb081ebd490f1893ac7a1a33c454092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557386, "uuid": "e0f503d3-0936-4c8d-9124-a7602efba5b6", "comment": "Malware payload (Pony)", "value": "51878b57b24d8661770f81e09e5fb43e2624e616097a1dba8bb45580a31552b7ce0a05aae0f1eb18d286b8675eab3678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557386, "uuid": "875debf1-e41a-4d68-98fd-1c4a88a6ae2f", "value": "T165947C31464BA43CCAB0A6B25C34976F13BEB6F26641CF5053EAC9D76F22202DDD8653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557386, "uuid": "afab3e1c-2e2a-4eac-9e88-9b8c7a64c707", "value": "7026debe3786bb28dedd5ecd45f354b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557386, "uuid": "4e224810-c968-4a43-b4c2-3fa2cf9cb124", "value": "6144:0j2JoVZdL5ZAtmzuLrEjeRSymQ3v29tBB:0qJoVZrZA0zunsemQ3ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645557386, "uuid": "d89a0016-8e97-4a65-9377-f78be985c118", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645557386, "uuid": "72b2adb2-466d-4b99-a0eb-cf26415874c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557386, "uuid": "3b62a125-2bd2-4838-a196-a9b504d9b6f7", "value": "B2E98BD78BDBA356D5522333004EF68CE5046B0C5FC36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487c23f3-9408-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552383, "uuid": "e8f8f319-2158-40ac-872d-a2a1afff47a6", "comment": "Malware payload (Heodo)", "value": "c63260b1c370c52fc6321aa16b7cd14f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552383, "uuid": "743fd266-6e5a-4058-9318-0791e8155818", "comment": "Malware payload (Heodo)", "value": "b2f6b0c68f3b6c71f42052378cea4336399dcc49e0281a64bacd69901dfb43c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552383, "uuid": "7be5842d-95df-4df9-b895-4b9a6083aa10", "comment": "Malware payload (Heodo)", "value": "b3f0bb7e0e9aaba3316cfd221b393a169ba8d2bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552383, "uuid": "5436b0b3-0e2a-4d23-8a0b-cb937c763dc3", "comment": "Malware payload (Heodo)", "value": "519d7cb2d76d8d85b8ee611f18140df8f36c918a7a3047e8e54297f62bbbe7060a0f0543c8757608f4ef40d8031fd4a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552383, "uuid": "744014a7-83c3-42b9-9a31-4dad72b9237e", "value": "T106A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552383, "uuid": "5a161055-1252-4480-9624-9574c0095fc7", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552383, "uuid": "3ff9f51f-fa8a-4b14-8267-6e638c0296f9", "value": "12288:vicw4w2Vb0zq6k5Z2mTdjqkGXNrGHORQuBT:viSwub0W6LmTrwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552383, "uuid": "d541e049-26d3-4a19-927a-eb01a09251cf", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552383, "uuid": "75dd3821-78d9-45ca-aed3-246f2560e39a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552383, "uuid": "ab3b5c84-325f-4c22-a771-54b1dc952f96", "value": "c63260b1c370c52fc6321aa16b7cd14f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3314f47e-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554924, "uuid": "78aa9495-9a19-4178-bacd-f997a7c9f693", "comment": "Malware payload", "value": "a9487d49a657dfcc1c2adc837c850618", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554924, "uuid": "eb03dd2b-c0ed-479e-9994-bb634d5c5da4", "comment": "Malware payload", "value": "b310e73a279cec4691bf9f4da86a4274400a88280468751cdc1bf4afd3ffdcd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554924, "uuid": "47bca996-8eae-4d0a-ad7b-fbd907df3b9c", "comment": "Malware payload", "value": "04bd6b7d35b10063c8aeb9c490ba0b76996744fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554924, "uuid": "64de013d-1812-4ae2-8999-c3feabc682eb", "comment": "Malware payload", "value": "3bb1ca4c8811002bd3f9eb94ea69324aa38549fa1864f2f7c0148fee1c8886f8b78ba7722095f09739cac90e56238947", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554924, "uuid": "cc8bb38b-f153-44d0-9237-6f8515f62215", "value": "T1B62375492E719FACFBAD863887B35F20634933D617A1DA84D25CE9014E7034E345FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554924, "uuid": "28343f32-fb2a-4a97-9937-c0bb5e260b14", "value": "768:vFHv9tYuOsNSgbt7MsJ7/gHkz7unyD7qPW+s672N9l9nJV1oGf:dF3SgDB4Ez7EyD7qjihnJIGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554924, "uuid": "3c2d1e5a-0447-471d-b140-ebca8784d436", "value": 47068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554924, "uuid": "8bd158fa-5b4e-41c3-bb07-6fcd5ed32f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554924, "uuid": "7128b3cd-040a-409e-a121-d792ce0a6340", "value": "a9487d49a657dfcc1c2adc837c850618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d263cf68-937d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492915, "uuid": "5670b811-5777-4d1f-a0a8-30abc7911e96", "comment": "Malware payload (Mirai)", "value": "dbd5bca6c4b09d1304be934b7f601f8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492915, "uuid": "04ef15f4-f95a-4418-a059-1cc528a41c6f", "comment": "Malware payload (Mirai)", "value": "b3a055aa34bdd4814d3d838f259bc1434c70ef420d95e7929bdcb762ae96f7de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492915, "uuid": "928dbbde-9b25-4a10-9c89-14847db72bf0", "comment": "Malware payload (Mirai)", "value": "055ddc6daaac4612ba1484738634f3256ddd8e01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492915, "uuid": "12b8da1b-7dc6-4783-8bba-f126aa67e7b0", "comment": "Malware payload (Mirai)", "value": "e45ad4ab16931a6f09e11b6d91b27e63a2c25e23f47ec4bb6821583432a09263ea775abf07635d9825492d8b7dacdb5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492915, "uuid": "328e3d2c-95ba-4e8d-871c-2d803be12e06", "value": "T19703F17066196A70EB300C36C85E765227842729E8EAB15FE26F0B32F4B1542AFFD4C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492915, "uuid": "c544a190-44e6-49ca-845a-8f96ede96dee", "value": "768:wDCmO9/u1I5KMXMPvx9YyRNuAGlIfYb1yorUNumO+rK5ps0pT9hq3UIbM:6CUMXMPLYYNulIfYb1/m2bOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492915, "uuid": "3cd0f25c-5b52-40e4-9d5b-0d4f4645cd78", "value": 38036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492915, "uuid": "6ba01690-5377-4882-9045-f82a231d6b02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492915, "uuid": "a46e863e-ec3f-4d4f-8cea-31e30b51a8d7", "value": "dbd5bca6c4b09d1304be934b7f601f8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea423ea-9428-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645566084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645566084, "uuid": "b20c071f-c8ab-4890-837b-ae4f729d9515", "comment": "Malware payload (njrat)", "value": "66e11b8e2c9d0c63c49b8acdbd029194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645566084, "uuid": "183cfeef-a370-442c-9ec2-61586e2c95ed", "comment": "Malware payload (njrat)", "value": "b4341cc7570f0ae53f0968f57a7246c7202a5528602d309adc46158136f33236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645566084, "uuid": "dae1411c-b3eb-4f2f-8768-975813c4a749", "comment": "Malware payload (njrat)", "value": "2f87ad0e5efa5e4f1139e49455746551e25f20d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645566084, "uuid": "b087f002-3fef-4ff4-9a58-587d49a23629", "comment": "Malware payload (njrat)", "value": "194564d43985329d7045d80b6b16ffe87cc032f56ab8e96f38ab0d166b6e6a6266485633900ac50f20f67b2b3e22d379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645566084, "uuid": "014ae9fe-67ef-4992-bd68-d348b8f64666", "value": "T15613E78CB784E175D5FF8BF1A492B2890B719017A902A30FD9F154D94BB3EC09A11EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645566084, "uuid": "e38ea442-e2e9-4a0f-98d8-a52c77a2371c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645566084, "uuid": "db06fb57-ed01-4339-a830-0e0238986558", "value": "384:cZy9iNUst+3gUy6f3b2+YMQj9JqK9D9O5UE5QzwBlpJNakkjh/TzF7pWnqSgreTD:ajwQh6/b98jqvQO+rK+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645566084, "uuid": "889459c9-42e6-4007-9686-15f7c5877ce7", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645566084, "uuid": "fc580337-72c8-4e06-9a47-3e9ae381de32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645566084, "uuid": "7b4ce7ce-44d7-4f96-a043-bcb05f7fb24d", "value": "B4341CC7570F0AE53F0968F57A7246C7202A5528602D3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446f444e-938b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645498689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645498689, "uuid": "d8c17ad0-24a0-4f33-b519-8e0012f36f9b", "comment": "Malware payload (AgentTesla)", "value": "68e7d396def8437096f410e63264b5bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645498689, "uuid": "3bd8c9cc-51bb-4f0c-8720-55ba94a9d42e", "comment": "Malware payload (AgentTesla)", "value": "b494f4b275a7388e79b3a04806d5408304c7440d64c99dc08b559dea6b2b010f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645498689, "uuid": "e78d8025-32c7-43f7-b14e-0f7a01b809ea", "comment": "Malware payload (AgentTesla)", "value": "93d0b526b294046219a7a357b527c85f867648e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645498689, "uuid": "e2844f0c-b656-4299-b41d-d3178ef38126", "comment": "Malware payload (AgentTesla)", "value": "b438d0338e17c49a88cc2b57022710006fe087c4baddb679a584048c188d41432c40b19bc8495a1615fda2992fac4cf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645498689, "uuid": "7b49e96f-552d-4422-b66e-cd0aa994d350", "value": "T1FD15479CE476C0E9AE258AABCD9CF5F08A39ADD1E00DD4A778C53E1137B1A00C9F1765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645498689, "uuid": "cd7d3c66-9e2e-4928-9091-1d6599fe9e02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645498689, "uuid": "f6181784-051e-4773-a51f-8842564bed24", "value": "12288:z1pby0chFFQWN4B7zwhwtV5nKfs4PMxVBUY98GMgaOgAgqy51QFYFefpvVl8V:vbHchFE7zwdfsRVBUYpMWgAfE18vV+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645498689, "uuid": "c4e86f68-a9e2-4664-9a8e-669b68398463", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645498689, "uuid": "4bad1a48-e216-4654-9500-016e939aa2d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645498689, "uuid": "ee66e3d7-aee7-477f-84e4-7b1e0ec6714e", "value": "TEX YEAR INDUSTRIES INC - Purchase Order (P.O.) No.4036041334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ed8508-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645514400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514400, "uuid": "98c8db5f-cc04-4ef3-8249-97ac60076114", "comment": "Malware payload (Loki)", "value": "fd000c90922d3af918afc90ae0c92614", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514400, "uuid": "c115782b-7399-4d56-8f4b-cc1727964b8b", "comment": "Malware payload (Loki)", "value": "b51d7e8dd4bef703497d9255bb38ca425c78528aad8f7e172a2d00983317990a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514400, "uuid": "9264b25e-c3a2-42e3-98b2-47aa31f9d3e7", "comment": "Malware payload (Loki)", "value": "4a09e68e013b4c67c0fce359f23d4d0fccde46e2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514400, "uuid": "8ca14d70-d494-4b43-bbf5-7ef455dac1e8", "comment": "Malware payload (Loki)", "value": "1f08529b968ac8bb95a4fc49783934207bbff3899efd5b9dc43c01bd40417f4234e0bf919b559e2ffeced16e17ee998c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514400, "uuid": "cf208e09-a109-4470-b65a-807f727ca252", "value": "T1801412573EDF5136F0F36DB1EC92942A5647EC0BB86D15C42234B28D3A72E8B4868573", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514400, "uuid": "91d15bfb-85f8-4df3-84f0-22b4cc3f439f", "value": "3072:zLxLKoPoYY53nodztgV3ry2+oN+uc3/Azj+rSA3mST+wTCpldnHxcA1o6WLIYIvZ:PxLKoQzeduFO0+DxrSA3xywTCpzX+Bid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514400, "uuid": "7ea816cf-8775-43b2-bd1a-593046785098", "value": 191784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514400, "uuid": "26654222-7d8e-45c5-9491-e6e9a9771970", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514400, "uuid": "cb9f88f2-404e-48be-abc3-cf69f5b5d6fa", "value": "AC 306455.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5cd5c0-93a1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645508175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645508175, "uuid": "d1aa977a-8538-48eb-9ede-f145e45e13e2", "comment": "Malware payload (AgentTesla)", "value": "678593eec85166322bc314215243e028", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645508175, "uuid": "b70c7eb8-d99a-475c-8ae6-754ca95abc40", "comment": "Malware payload (AgentTesla)", "value": "b5cbc863c60487ff5586b406f464a918dacc60b8f5ac5ea2c9a9381775c9c27c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645508175, "uuid": "5a9ad0d1-7b01-4edf-9b51-50cde132dd87", "comment": "Malware payload (AgentTesla)", "value": "964dcc32a1fd3616395aca10f5b53d4cafde517d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645508175, "uuid": "922bb55e-a5b1-4893-abfc-39b268e1eff0", "comment": "Malware payload (AgentTesla)", "value": "f731b7822e2a2c52d6dd0dc6f4ecb6d155e842f39980a1e86d83883e715b9babc192f2732f8f3f79b42b8bfaa0fae959", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645508175, "uuid": "4d370d02-c319-411d-bac6-135e162c1f6f", "value": "T120335B127B5BAD12C4260A32D0DB612003B26B833167C69B3AFDC55BF7527C25F94B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645508175, "uuid": "366a62c1-d58b-4ae4-9805-48b096c1b6de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645508175, "uuid": "8ba44dc6-1836-41f1-b134-c592a7cc2728", "value": "768:xRqQp6BbXIlvSP2hBzsxnEXfB5Q9XAeWUTg2GzWUDG6hVQ:5QBXIaefAqQ9weWUMWWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645508175, "uuid": "c9d356e6-7228-4397-932d-88e5850d21cf", "value": 54472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645508175, "uuid": "fa1cd2a6-8347-43d2-80d3-cb8530083ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645508175, "uuid": "e83369b8-eeeb-4544-afa7-b5f0c027d972", "value": "ITEMS 222940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e2ef93-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517536, "uuid": "6aa2b3ac-be1b-4001-9c77-c83847216f8d", "comment": "Malware payload", "value": "41e74246e6e84a332a6b3363a5553a77", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517536, "uuid": "51f767c7-4195-49e5-9ee6-521bba6cd120", "comment": "Malware payload", "value": "b660114faae5948987410f08e19ffbdb97c5d132aafc543a017b8f41b9b89539", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517536, "uuid": "a80a2bce-03a3-4983-85f8-2b3bd3f68414", "comment": "Malware payload", "value": "2f59c7e6f1480dd7ef62146a16f0b74b99c138c7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517536, "uuid": "97aa2740-b2c7-498a-bd69-93adc7e56d1f", "comment": "Malware payload", "value": "467f1e91900a05b335c9d12c2181f311883242f39d0b0b3a7f0fdf948f45a64f28bc02ffa158604be588499237723c21", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517536, "uuid": "a59b95ca-3629-4021-aa56-e573331bbd65", "value": "T160547B06B7D6027AE5D74332279B5362DB31EC388262422B5245B90E7DF1594FBE32F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517536, "uuid": "f35f1916-2ca6-4e1e-8e26-2d15dc3e30da", "value": "3072:vB97NIA+/WQx5TYD9yOePn75N77Qwgz88ereWn/7w05g0a9oYI3DaAgjuLycZ7E:veb77h8er1nzTxYI3DaAgjmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517536, "uuid": "0c1c37c0-5d01-4717-a1ac-91b5fdaaa5d0", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517536, "uuid": "f29c0599-5505-42ca-ac5f-a9792d80107b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517536, "uuid": "c5f26895-6e66-4f09-ac93-cf151c3dfef8", "value": "_-__chky.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe83a95-93d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531082, "uuid": "ea75e08b-ca0a-49f5-a038-2db9d801a224", "comment": "Malware payload (Mirai)", "value": "82cea92b1e420b6a7a742f7f2e918139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531082, "uuid": "2ef1c2a6-4e5c-4040-8a03-44037c6463ce", "comment": "Malware payload (Mirai)", "value": "b69297b5a0c618d105a2e23e709969534f1392dcd4786c4857c1d12d00e672ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531082, "uuid": "bf60ce04-1b8a-421d-8e50-17bb18070a52", "comment": "Malware payload (Mirai)", "value": "6d20c8ee3b38406b27855b5200211ef7cc723b6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531082, "uuid": "73c74a78-76cc-4f06-9a25-4785e2b248f1", "comment": "Malware payload (Mirai)", "value": "ee2fd4406226c4b026629821089b8e8b8be158322444a6c52efa597876a0e6777ddd4d8f79e27c94c7a80adec63a6dab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531082, "uuid": "08383e50-6384-4278-9000-40d904cb625d", "value": "T16653C72A6B228BACF25D923547F34A74966923D137E1D1C0E26CE9041F2534F68DFBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531082, "uuid": "18c44109-acbf-4768-8694-ea95d693df3d", "value": "768:tnQcAYpdB2uUCLSCmA0exSmp+hVbLrCEhwn5A5OSm7KCmLbVbmzgU14gsxHZNYtE:+chd8uUMm+cLrC9W5OqxbqJsNs/dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531082, "uuid": "ae0d51ad-2fdc-4d3a-a44d-dfcaec797bce", "value": 65748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531082, "uuid": "36d75628-b521-4336-8559-0b0cb44f51d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531082, "uuid": "bcea0936-f9c2-4b76-b475-250b0e332a10", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd11323-93d2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645529223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529223, "uuid": "f642ec9e-ab53-4d15-b6e7-40eb3dff8617", "comment": "Malware payload (AgentTesla)", "value": "3645adac86d6315a8da5083d819ec236", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529223, "uuid": "804734c1-efe9-4b6a-9b81-3808f41aba4c", "comment": "Malware payload (AgentTesla)", "value": "b6b90cdf2c07f42826129b55d85408c8c6c80e1603db642f7881735a7ed1e1b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529223, "uuid": "e26be0f6-d19e-4da7-a320-cc6fefb8cf2f", "comment": "Malware payload (AgentTesla)", "value": "dbfa0fc954578e88fd9fcaf5d80769e0b49f3562", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529223, "uuid": "c17dee9b-8df4-4736-8c86-0bbc277c1493", "comment": "Malware payload (AgentTesla)", "value": "582668c90a611d3d0bdcc947d781e37e8c7bcadae790e043c0be0f0a45b70dad5782593e8e714bc8bfe5f583bf7de98a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529223, "uuid": "a055f0d1-5ffc-4d99-86ec-39ca9d47f973", "value": "T18C03F71A7892961DC5D47BF869B1A19366367CE10124C18FECFDBF29A933223DCC216D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529223, "uuid": "fc942978-5aa1-4ca1-9c76-fb14932cf6ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529223, "uuid": "f2e4402a-9b9d-43fc-927b-a27b1b9a837d", "value": "384:8MiubaA4YeK7PQ6ulaiJMwCKTH2S3dd0hUADkadi:8hubTTrml7MwCKt3deVDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645529223, "uuid": "f4d76874-bd8f-4021-b250-24eeb241a3bb", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645529223, "uuid": "89dded30-cb9e-4b2e-8043-066bcf028576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529223, "uuid": "38b2aaa1-c142-4077-a215-8a5d400804ce", "value": "Rjhmutrk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c4e4d2-93d4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645530070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530070, "uuid": "5496258c-d2d4-497a-8d68-215c48f26128", "comment": "Malware payload (RedLineStealer)", "value": "bb050ee971575ba75710b8be59da3abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530070, "uuid": "66aa800e-0c26-4226-b794-8d57f503d65d", "comment": "Malware payload (RedLineStealer)", "value": "b7b523a093c1f316afcbf8367d73f9a29ae16fae60cac20343656a3db4e0f496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530070, "uuid": "c24077fb-cbe9-4b34-8716-0237ebc233fa", "comment": "Malware payload (RedLineStealer)", "value": "5691d7f2431486235f303fa53df9383b86a2374f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530070, "uuid": "88054913-0f79-4292-b4b9-e62415e84676", "comment": "Malware payload (RedLineStealer)", "value": "b7a360be8c74b54fdffe4bac8ab07bd17028d35b2cc4a176450a6f8b814e24003fa0d64164c95f92aaa37dda854a0853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530070, "uuid": "0d5c86da-4dd9-4bf5-b234-e397818a288d", "value": "T1422539D5E0289091CEF8B5F2B8A6E92520F42CAE8DC3454D36F932362472997DE0F55F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530070, "uuid": "2e62e3b7-98e5-4c20-9aeb-8e50cfddfd1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530070, "uuid": "b7f5de24-4eee-4d7a-9c07-2e5ddb33960d", "value": "6144:IMryQ9w1O1rXrSeKBUKolPCKZxGfAb7nC0WEG05iTwsHA4aHjwTifAb7nC0WEG0k:DyQa167SinPV595z295", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645530070, "uuid": "78c34cfc-214a-4ca2-bded-b0e10eacb55f", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645530070, "uuid": "32abe527-cda0-48da-b0ef-2091694c0457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530070, "uuid": "6745f3f6-4c8b-40d5-9809-c91aa98cf8da", "value": "bb050ee971575ba75710b8be59da3abe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53d5b10-9424-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645564592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564592, "uuid": "021f1b2e-d7cb-4844-abe8-ef7d02b40242", "comment": "Malware payload", "value": "69b409313d92f5c1bb320aeb9befe00d", "object_relation": "md5", "Tag": [ { "name": "ch0nkybear", "colour": "#885658", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564592, "uuid": "636701cc-4e58-479f-8187-f56c35fd096d", "comment": "Malware payload", "value": "b80947799ba2f5416a9077fc22ad3d63951d209f7fe67b27f72938612cfa0e9e", "object_relation": "sha256", "Tag": [ { "name": "ch0nkybear", "colour": "#885658", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564592, "uuid": "23c5cd16-83b3-42ef-88a0-fd978cbc0262", "comment": "Malware payload", "value": "fe38b1090257aedebd8aa15c71a9658d1d9d7488", "object_relation": "sha1", "Tag": [ { "name": "ch0nkybear", "colour": "#885658", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564592, "uuid": "dff38187-6f92-47d4-a862-030758bd08df", "comment": "Malware payload", "value": "957713ed4ee0ccda488284a2ff15bc25731f55ce7f74166c48e3feb4886348eaec46727c42b4726c8ddbbe2d3aeaf5e5", "object_relation": "sha3-384", "Tag": [ { "name": "ch0nkybear", "colour": "#885658", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564592, "uuid": "1de32c14-f0a0-4f28-b9fc-e4f4609b271a", "value": "T105234A4EF3A358FCD28BD27452EB5771E872BC3305319A7E87A8E7300E15D509729A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564592, "uuid": "996b8697-9e45-49e9-adfc-f2d252fd7178", "value": "cefd6e93ee239f140a8acc2be2555efd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564592, "uuid": "3e4b60ae-36f3-49bd-9706-7addc8f5ae73", "value": "768:KNrlOJEAeEs+UoPxkvWtJ2sRTmVHDMoZG+n2jXrOXecG1Fl:sgJTPsAka4slkHtz2GXvG1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564592, "uuid": "88447d06-e6b5-4b06-84da-1a80efc9bef1", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564592, "uuid": "2756d772-9fa7-4785-804d-ea83afa6a04d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564592, "uuid": "72a08362-cac6-42d0-b07c-d1718126503d", "value": "Invoice.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9ebd14-9400-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645549174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549174, "uuid": "f1841528-1eaa-45b7-b96d-61c9bba83798", "comment": "Malware payload", "value": "e5367aeffbaa22b2ffa289a35f59ce1f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549174, "uuid": "e70cae1a-4d71-46fe-a5f5-fa63f2da0a9b", "comment": "Malware payload", "value": "b84e0f2a2a642b02b6de213877b7659271de80190203495c72dadcc66ef9b0ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549174, "uuid": "c0172391-ee32-4127-b2b9-fe4626cbde0b", "comment": "Malware payload", "value": "70c6de5fbff5c577c3b10132f3574f1f9efa7597", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549174, "uuid": "dbfaa93a-5f0a-4b9e-9aa1-19ad0f2c76c8", "comment": "Malware payload", "value": "5837c6d8ed20f76137117a230a4a73e0eff736f7dd79797164a1c347264933a534038e07c1f3cf2206bcbb1af337b174", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549174, "uuid": "d8d6d8f8-5383-4443-a4d9-7c5af5c4d682", "value": "T15341DFC5327E588C43C77349E37998898CBDF831E1598C7CFA51908CE9E2269A7C05BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549174, "uuid": "bd44e0b8-8703-4a2c-8c2c-63b5a0c46a17", "value": "48:1rc5vgevKgXLyQOjZi3vsqt0JWLBcNlQW3iMsQxNOaw:Z+fv8j9YLBcN6EiMVOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549174, "uuid": "d6f65696-f7c9-40c2-b702-a5b4c1fc9f6b", "value": 1886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549174, "uuid": "fbe29fdc-5ae9-4fe0-972f-80548d2e9a9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549174, "uuid": "cde7acd9-13c8-4c01-be12-f61546b2fcb0", "value": "Chrome.Update.bfec88.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e2cd1c-942a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645567004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "17a5f55a-0270-4c9a-8a83-702953afd64c", "comment": "Malware payload (Heodo)", "value": "3a00dfab5adec455aad387dce3ce6cdb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "038d82b6-6abb-4a0c-880b-3c99639482dd", "comment": "Malware payload (Heodo)", "value": "b90cabf1e6626df11d3186d5e68019f1a45b2fb70c9b7c4e5bd8911ae62a6b6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "79781228-3403-435b-ad18-87a77a5a7f31", "comment": "Malware payload (Heodo)", "value": "1952823972eb7a8e1bd1274efb9016d02b09d8d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567004, "uuid": "3f9b5aab-9623-453e-b4b5-3dd742a5062a", "comment": "Malware payload (Heodo)", "value": "92baa25d1b29415a7ac28c649b5c005ac04d297d57485b072bdb4bf97e6adaa1261003e0b2d104d157c96702b8167817", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "14b23138-3d51-4f41-a3d6-65d2c37d77c5", "value": "T15DB42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "2064b8e5-50bf-448c-81bc-476158442f69", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "26617b72-5ce0-41ca-8a10-7e5a8c8c85f7", "value": "12288:IOzyEtBX2ZHq79+p6/G5YgvmgZDa6A9TU:lnmZKR+DYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645567004, "uuid": "fa253276-ac5e-46e3-89fd-1668d68e3d92", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645567004, "uuid": "f3968edb-900f-4603-bea4-02c9c8c64176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567004, "uuid": "5aa61dd4-b63b-4d36-b18e-96ef59f36fa4", "value": "emotet_exe_e4_b90cabf1e6626df11d3186d5e68019f1a45b2fb70c9b7c4e5bd8911ae62a6b6d_2022-02-22__215639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be52410-93e6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645537813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537813, "uuid": "4e1a83a1-d4b8-4cc5-adca-b002d89363be", "comment": "Malware payload", "value": "7c93930a74731a491057744878bb2d30", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537813, "uuid": "d3a97b2d-2767-425d-a9f8-dd1cdeeff0ee", "comment": "Malware payload", "value": "b949876ceeff8f71ca0693e2491b4854bf1ed00d5dc40348785605d1992433f1", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537813, "uuid": "4ceebfe0-c0fc-414d-a981-b27f85c46573", "comment": "Malware payload", "value": "bd11ddd0a67de98f3fcf2cdec0fa734a9c74ece3", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537813, "uuid": "c9ae8a32-81d6-4cec-b8cc-d552b34400f5", "comment": "Malware payload", "value": "f12d090871378b349a6fcd4709e3ff6d5b7a4b4607f151582b2b45862c4908af6ab6c3302d74586e0527d4749cd22236", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537813, "uuid": "ec04c52a-fff9-4dbd-b7f3-049bf9a7f9ba", "value": "T1DB41EA348E52A242CB9A03BB68AB4921485B141B973F0939E7465BCE8D314D947902DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537813, "uuid": "2727283a-8578-4ceb-95b6-0c2eb8f4e382", "value": "48:9Ny5iuFXij4A60xBL6xRKRUebvynmW/UQf1I:Py5igycivMKRUMXyUQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645537813, "uuid": "99425232-de00-4022-b92a-0dd9dc6e497a", "value": 1975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645537813, "uuid": "0ce513e5-2923-4b65-b4ea-896e51d48690", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537813, "uuid": "3de1f07e-9762-490a-8481-996c8a605901", "value": "documentaz_190.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2955c7d6-9374-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488766, "uuid": "9153744e-c69f-4165-a1d0-6f0430dfa3b3", "comment": "Malware payload (Mirai)", "value": "8bc308e4183cc483f3b03c026126438d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488766, "uuid": "420f224e-54cb-48ef-b58b-d11bc145a939", "comment": "Malware payload (Mirai)", "value": "b95fa7e2c33f98762c38322e0fe2b9c08e63dbcba30a5c977756106615093bd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488766, "uuid": "c7af51b7-6e90-4576-a282-ffc88cce8222", "comment": "Malware payload (Mirai)", "value": "fd246765874f2878d2632b8ee0fb112b71cdfbea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488766, "uuid": "e7408fdf-507f-4822-80b7-eb9ee96f984b", "comment": "Malware payload (Mirai)", "value": "e58b3085c2603e5c795f2cb6102e09cadd6157781ee485337247b309f870843a638541ad41a3fa2444efbd99cfb2266c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488766, "uuid": "2dfb901e-519d-42f7-85c8-94b232307835", "value": "T10F4302E3801EE53890310537F4750293529B397C42AAFB3170D606CA76B195FCABACD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488766, "uuid": "bc996137-0d38-4431-8fa8-357dbbe892ac", "value": "1536:uZZxmkszd/akgLH5rT47CfLEkogv5oMpvvFgG81:aZxDI/wyGTr5np3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488766, "uuid": "d18bb5cb-9f6c-451a-8dcc-7e7ebbc2d7e7", "value": 59724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488766, "uuid": "3a1520f8-96e2-4f0d-93e0-904904ca2f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488766, "uuid": "78ba5b90-970a-43e6-bda2-24e01ad34127", "value": "8bc308e4183cc483f3b03c026126438d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9df7ba-93b4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645516318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516318, "uuid": "c3fe9636-a440-45df-b93b-e09eeee0802b", "comment": "Malware payload (AgentTesla)", "value": "969168d1a8cfbec91eff63cae367325d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516318, "uuid": "f77379b5-2d72-42da-baaf-146fee6ef5dc", "comment": "Malware payload (AgentTesla)", "value": "b9622e1368f8d0db6c78af601ada94e4a72f0ab497cdf2a22ae153023f49ae95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516318, "uuid": "412ccc51-98c0-44e2-b659-813fdb154dbe", "comment": "Malware payload (AgentTesla)", "value": "315335e9fbb4ad7a68b02abd79e71f17c13ad39b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516318, "uuid": "4d1f1f05-652d-420c-a38d-2e95aacea2da", "comment": "Malware payload (AgentTesla)", "value": "383c1fecdfb4671302b4e57c8fcfc3ea7ef54a146c28d2cc6d74e6424510d07ea7491ff009ade396a57b1f9317a53a3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516318, "uuid": "f7dbd5b4-7c6e-4435-ace3-304928c8fbfd", "value": "T19615CF143AAB0F3CF1B94BB249D0EC64B769F7231C19F37E78502596CA52B508D826B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516318, "uuid": "ba6ffe67-03ee-4081-b807-97e337b61377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516318, "uuid": "2a923e36-6c43-48b3-b1b1-35a9a6895727", "value": "12288:EgB61RauKfuNoh7j4lLa9JjQDt8ILMQ/CIRe9pJlzotCnEhlz1/H8LeFXCUk9Igg:WRyWNG9SqItO9pj0Nx/HyILI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516318, "uuid": "d40f14f4-dbde-4053-a498-89bc36e76a01", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516318, "uuid": "54a298ce-34e4-4820-aa3b-b960ed03d51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516318, "uuid": "88c1a2ce-2944-48bc-b024-e143e79bc8e3", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348a726a-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645539035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539035, "uuid": "44a5f2f7-d575-4d8e-b58a-2dfa90d0aaf3", "comment": "Malware payload (Formbook)", "value": "23e25cb565d4e968ec0d3efa84167eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539035, "uuid": "c690497f-c372-4ce5-89b9-b17c92b41089", "comment": "Malware payload (Formbook)", "value": "b9813b287539627cd489acf71c0036f69b9ab5342f301e793223868aa25156d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539035, "uuid": "fd1d2c7e-3517-46c4-9463-d5ddd7a5610a", "comment": "Malware payload (Formbook)", "value": "2af06427ce388e7515077762e56e6bd9926fe387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539035, "uuid": "e822213b-04c0-4a42-9fed-e0ef94e7cc5f", "comment": "Malware payload (Formbook)", "value": "b19f9933966051ec34ae8e590fea5dd9bcf0fe14df2a11d267f4b0312fa084996eb071b45c4625b8f041cd28767df6b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539035, "uuid": "d330f601-c1d2-4348-88a5-c8fdaf1d7e93", "value": "T16805CF042AAB1F3CF1B94BB649D0EC64B769F7232C09F37D7C50559ACA52B508D822B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539035, "uuid": "25cd7d62-2a72-4a0b-9795-e262345e2e21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539035, "uuid": "b66cb945-9495-40cc-8a91-249498c7ddee", "value": "24576:o7TNfnBzBea9wRlBK6g46JCDei+v8bgBWo:YnJYa9LJ4I0ei+vRBWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539035, "uuid": "8f163535-3b88-4d84-97f7-3c57db47270d", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539035, "uuid": "11bedcb3-b290-4248-9edd-fa8c70916f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539035, "uuid": "4718969a-cd5d-4084-af73-e05662c084fc", "value": "MT103 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c71d02-93d9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645532276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532276, "uuid": "8490789e-b42b-4c4a-bda4-354811d332b0", "comment": "Malware payload", "value": "13b4f7e1cd3648641d0214840bf856b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532276, "uuid": "48422c88-26d2-4d86-9953-3b8eec3ab670", "comment": "Malware payload", "value": "ba95db4fd8ed35b8434a97aee85c4a825c7411e48b490664f147c806d434f6a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532276, "uuid": "07a86242-32cf-423f-af93-34e7f9a00329", "comment": "Malware payload", "value": "aed7ece6597eb6d99eb7de19f991a2d2780837b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645532276, "uuid": "cebb5c39-7985-4c77-8859-805505c8aa16", "comment": "Malware payload", "value": "00c793180aacba68c4b5c5b9d8e6419c6b76da2059fd321dd22dcd8e025194e3156a9ab6f0041854fc15dcd787f94259", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532276, "uuid": "cce2bd13-fcb9-462a-875a-c2830469bf5b", "value": "T140D47D911EF6CE52D7E5477684F59A009F31D026342BE35F986D22BA3887322793ACF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532276, "uuid": "2933b5f3-c4c2-4cac-aea6-31d2277af301", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532276, "uuid": "b487a6e5-fab0-4e25-9090-40f01a08621a", "value": "12288:azg4xszZ1lryv+pxC/LwRe62Ntljw+sUxaIuwW:QEfemjQsRx2N/M+sB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645532276, "uuid": "3213e3ee-5a79-4525-9a5e-e67889c6105c", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645532276, "uuid": "2d5ab340-4806-4df7-b5fc-6b00aec10f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645532276, "uuid": "46fb8cde-f9be-4bca-b192-43a05ecc7305", "value": "Pgmxmmw.jpg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc15848d-9385-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackCat)", "timestamp": 1645496313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496313, "uuid": "5c1ae132-f440-45b8-8ccb-85e248b81c29", "comment": "Malware payload (BlackCat)", "value": "87f9dd02e0c6346e6d1ca3957a83709a", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496313, "uuid": "b017206c-b17b-4a40-8186-e133284509ee", "comment": "Malware payload (BlackCat)", "value": "bacedbb23254934b736a9daf6de52620c9250a49686d519ceaf0a8d25da0a97f", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496313, "uuid": "9d521e68-dfec-4b55-b3dc-514003b23c71", "comment": "Malware payload (BlackCat)", "value": "1d6e2aeed499eb7d317b92b42d4a784b22d02dc6", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645496313, "uuid": "7d4ce270-ba44-4337-a363-a4f5ccfe5735", "comment": "Malware payload (BlackCat)", "value": "d3bcb9aebf39770a7466db5fb9f6027ced55f9a97953e328d6df5343d2a5e550177c3c654d060d1a8fd04b409cb2459e", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496313, "uuid": "f9af823b-5d06-49d9-8a04-f48f90375c6f", "value": "T1AAE58E47F98356A9CDA71A70305EF33AA6314818452D8EA3E7F8DD207B2E7105EC9E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496313, "uuid": "c56bc4f5-c8e9-4ab7-a4d6-7eb4d5818458", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496313, "uuid": "4ac6d3e9-2882-4b53-ac5e-637a1fe88b36", "value": "49152:HFyDutqkpj1TFUoXhjEjHjTu5tCeOZobIMfutoqKNb/RgaJ2weF:HFyDkNLXVEbjTuieOaR2+bvwweF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645496313, "uuid": "6334f0a0-2264-499e-b780-10e189f1dfdc", "value": 3081216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645496313, "uuid": "18487dad-9b71-4bac-bcc9-f45783853a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645496313, "uuid": "69a09f75-6689-4dc1-ab54-0b6e3b11a1f2", "value": "bacedbb23254934b736a9daf6de52620c9250a49686d519ceaf0a8d25da0a97f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112fd15f-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645514065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514065, "uuid": "f7320f08-c8e7-402d-913e-0a34536e7126", "comment": "Malware payload (ArkeiStealer)", "value": "8eb2d3ea3df33149e8c184d1236ab866", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514065, "uuid": "2c3cadb0-d311-44ae-bed6-f34f63721106", "comment": "Malware payload (ArkeiStealer)", "value": "bad66b8f571e33037b0c2303aa457ed4acaedebf3698f257d09a6f646d22f623", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514065, "uuid": "2ed466af-7082-4bdc-af69-7be7271cdccb", "comment": "Malware payload (ArkeiStealer)", "value": "bc393ceeaf7d6b52dfef8b3a13cee4c173d20857", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514065, "uuid": "acb3b0c5-0b56-4caf-bb12-d508e65999de", "comment": "Malware payload (ArkeiStealer)", "value": "b5f849f1ae92acb489b02fab54edb24c6302f204a21f05cd950199c0c47d0d631bc85603eb600b70b40982cbb2f74c4c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514065, "uuid": "2d69c2da-307b-425e-bf08-58c30413b391", "value": "T13FD412017580C87AC4A19E765839E6A0123BFC6349B4D647FB5B7F1E1F703606BBA3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514065, "uuid": "7e012919-f57b-4294-b5f8-966ac6778f9a", "value": "4a4bc9cc389c61fb8202ceb2abd92929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514065, "uuid": "e3144cd8-789f-43ce-ad4b-e04db9197ce0", "value": "12288:dUfH4+GqwzzrVgpOW4iQiHBToJAdsqwI4/wdyvyOagKokgCN6oOqsC:Yhwz3VgpF4sH5tFwX7vOgBkgOjOql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514065, "uuid": "a896f022-58a9-456a-82e0-bc26efd8b27e", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514065, "uuid": "d6e2ec32-88b7-486e-8566-d84ef64b753e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514065, "uuid": "a1090c58-854e-4e2a-bf42-a8a10d71394b", "value": "8eb2d3ea3df33149e8c184d1236ab866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4817067d-93ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645539498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539498, "uuid": "046f79f9-0687-4900-b9b9-5b36b96c01c5", "comment": "Malware payload (Formbook)", "value": "5f6b40487d5f91deade11dc63c4fd310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539498, "uuid": "0cd87274-6dda-4339-92bc-8d1209e92eb9", "comment": "Malware payload (Formbook)", "value": "bb2ec0195e4882f7c36dfde1f7bfc4d38310d3e942ac4b05d199c10e9e475bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539498, "uuid": "5fe1ef57-003b-46d0-a909-33714e812180", "comment": "Malware payload (Formbook)", "value": "362dd3ada3ff331484a19d07f2c4f512bddebb64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539498, "uuid": "3a550071-96fc-4d73-a156-03bd73f592e2", "comment": "Malware payload (Formbook)", "value": "eae739ab48bd6838ce86fd59e4346350b937a5841ad0876286ef37c164d0bdd9f031439a2283d477774e3be838606e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539498, "uuid": "89127f5b-348e-433a-a53c-61a1b349d853", "value": "T1E034127E5EF189B3C5E902304BF7A3B4A6BB5A80A63127572F5C9F2F36232C39450516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539498, "uuid": "016a8d5f-9c0e-433e-ace1-6f44d65f3a48", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539498, "uuid": "0f802a08-0562-4570-89a6-3cf83024410b", "value": "3072:Tx6UW6tpmJcs4ko2kGtKQw0HMFzDEyX7qr1rVr/8jTnZthglPGXJwR7Mpc8CpI6i:TxDkFsFzA/BknTh8PGZU7MVl6qve0j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539498, "uuid": "45a1f9c6-fc18-4941-a4d3-ce8f5f0edefa", "value": 242373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539498, "uuid": "dc861cbb-88ce-45d5-b50c-e2ca4785a33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539498, "uuid": "7a659df4-bc9c-4406-acf4-b594f1195e00", "value": "55509BS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1815ece-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645513932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513932, "uuid": "20bf8ff8-4e95-4266-9370-efde6e16dbc3", "comment": "Malware payload (SnakeKeylogger)", "value": "9b17e0f4329982b4be55863f880219b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513932, "uuid": "a58cbbb6-4e6b-46c1-81dc-854679c630ca", "comment": "Malware payload (SnakeKeylogger)", "value": "bbb17b488f335d22e932516e0ce75d2270bd0168ba6c306301bd764b8607297a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513932, "uuid": "96751601-af17-4afe-8476-67b7fcc0994c", "comment": "Malware payload (SnakeKeylogger)", "value": "01c1f7370a1fbee6bc2d47fa0904606f031f7366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513932, "uuid": "513efca2-ba90-445a-8e3c-18bb85319597", "comment": "Malware payload (SnakeKeylogger)", "value": "951213d72f920461ee358b75218210edb04f17380131682102098e1c9df9992d354e4613198f8b35f658a98e69c8488d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513932, "uuid": "677cd17b-a1d0-4e42-b291-29eec8c46a91", "value": "T17205BE5631FF1056C7A2EBF20BD4E8BF866AF173160F753A31822B46C766A40DA42375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513932, "uuid": "ca2f18fa-e4e7-4539-94f7-6f1ce6b3d83d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513932, "uuid": "17484af5-2579-4dfc-b66b-45e388c77b22", "value": "12288:05VkojbrlIo/OHpQ3MwWGVosTpz+EzpuFBVkuiPBthy59M1xdMrb9td3446:2brlI2besTtz+fk5TF3CVZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513932, "uuid": "20a85c0a-40ea-44a3-9321-47d2c577f951", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513932, "uuid": "0816387d-5542-49a4-a348-6ca69cea9e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513932, "uuid": "740181b2-6c44-47c2-82e9-70ddc9989feb", "value": "9b17e0f4329982b4be55863f880219b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54330654-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531787, "uuid": "a572574c-ca65-4c0c-ba77-836880cb9cee", "comment": "Malware payload (Mirai)", "value": "44ae65af2116dae929c923fcea305abf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531787, "uuid": "a5f607c7-42ff-4730-b156-fd3799c12709", "comment": "Malware payload (Mirai)", "value": "bbe08144858b7fe99071ac19a873266a7dc1d6fc9e6427ad6c7c34f1e7fae864", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531787, "uuid": "b66c535f-811b-42bf-80cd-ef56e0f9831f", "comment": "Malware payload (Mirai)", "value": "27bdd22a6ad17c5e3798cc7a97ce962eac57132e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531787, "uuid": "4d6b7d8d-3374-4440-9812-a947b5512e83", "comment": "Malware payload (Mirai)", "value": "59d85f0916199499cef02a3ddc10cc3082de3f1dcc4027b8a611fdc3bef7f16a9aba58eaa935157e766181a17de3b01e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531787, "uuid": "98aa2bca-6fda-4fbf-9935-c9dd8b7e6464", "value": "T1B5634A356D7A2E27C1C0A53E22B74764B2E1578E3AE8CA1E7D730E0EFF50A5060176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531787, "uuid": "6937a5d5-42a8-4cbd-98b1-a503e69d1097", "value": "1536:xBzNxnVCvXUB5HtSxZ8ChB4VXgy+j/9T7B:fzMx1vcwD9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531787, "uuid": "d65d20ec-d305-4406-92f5-99f53aef6994", "value": 72800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531787, "uuid": "bd92ffe1-33a2-40df-9d14-2865d003a8a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531787, "uuid": "17397867-a412-43b3-b6cc-cfa2912fcf4f", "value": "vcimanagement.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb546b2-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528203, "uuid": "649a88ba-316f-490b-b9ef-bbce51a41270", "comment": "Malware payload (Mirai)", "value": "95870e28818b55416a1a2280bc54b011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528203, "uuid": "9734faf5-4242-4f3d-badd-44f0510d8169", "comment": "Malware payload (Mirai)", "value": "bbe1cb82aa8e9a77d63b7e30f1871cbb862fea2b2a0ac99edf87c6fd0e565a17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528203, "uuid": "0e19c6f5-1db0-4a1e-b7c3-34f2d0a48497", "comment": "Malware payload (Mirai)", "value": "6cef97f2d3c0bbf6f515fef5b8c41b568c83f67d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528203, "uuid": "8d3cb936-ac21-4402-97a2-83fad573e2a0", "comment": "Malware payload (Mirai)", "value": "d27868501fe4f83b8d5a043ba7610ab4dea8f9a2b514487f0701200b3766ef8590ce3c7bed461e3b9f3ba4e938e15d04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528203, "uuid": "e0ab1835-4d37-496a-bd0a-d4a92802921e", "value": "T151638209BF611FF7EC6FDC374AE91B4525DD641A21A83B397930E818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528203, "uuid": "60556be0-d78b-4ce6-9f9d-a02b65ba21be", "value": "768:CDScD5GY2naf8i2Sxt9yYExR15I7I5vTemle5Re5bbvuH5XiANe1j9lE:CDSC5G9afb249FKeI5fl8RWbriq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528203, "uuid": "d96d283a-dd8d-4ad6-a428-ccba12060f46", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528203, "uuid": "737e26da-9b85-4994-a85e-78470a5563aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528203, "uuid": "5974e2f2-7071-4a53-815c-fae18e5260db", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e947cb4-938e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645499888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645499888, "uuid": "ad833c69-ff1a-4f14-9aec-aae391220f10", "comment": "Malware payload (AgentTesla)", "value": "5cc5b2ecb2a2ca7fd986f6b25b56c06c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645499888, "uuid": "257d162b-866a-4822-861b-793436c5f4cf", "comment": "Malware payload (AgentTesla)", "value": "bbfc056b46844f349c2659b83eca67889f4f76884f6d7d7698c505884dcdd04e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645499888, "uuid": "a7fb908a-8565-4158-81f4-728cac96d09a", "comment": "Malware payload (AgentTesla)", "value": "5fb6477983cc1562c8371c01bf2554b4fe888e33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645499888, "uuid": "fce48df9-3caf-495e-b617-87e6d90894f3", "comment": "Malware payload (AgentTesla)", "value": "7c92d3053667b0c9e9d8459385eaa242380fd96132b675d390c1d1f4daccf4932de6a54381c43109ee872cd66364420c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645499888, "uuid": "9ccab321-03aa-4ab1-8775-bd91e7ca379f", "value": "T17FF46B9416847E9BD9FD12B562140C05B3FE8E926211EE8E3DA0F0D7D6E3A324733799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645499888, "uuid": "276045fd-6b4c-4585-af34-6f3a8bf6a3a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645499888, "uuid": "fa3b7f67-d62d-45af-a218-ea8b9bb6fff6", "value": "12288:k50Jpvgj506v+eclHnt9yDFyqS/Lj9XUUFY9be7tHGYG0SgyXsAnl:S0Tgj5RIlPyDFyqSjprFsktHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645499888, "uuid": "0e660e0d-0398-4982-be45-ec49444985aa", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645499888, "uuid": "902b0b9b-9c28-45fb-90f0-08b01cf7787e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645499888, "uuid": "95db920a-f16a-4b73-b844-cca94181348b", "value": "PO#1135 - \u88d5\u5049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31def5af-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517556, "uuid": "6153aa8d-a780-44e3-8dac-d15cae286d4a", "comment": "Malware payload", "value": "1b2a491cab4428fe9ae8f47bc725fde4", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517556, "uuid": "ec560dfd-c284-4108-92b4-7ba3dd97ca63", "comment": "Malware payload", "value": "bc8de80a28c8ae55415ccdfece270f6548f067fc2a00e799baf0279d4d560807", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517556, "uuid": "f6ac144e-d14c-47cf-bf33-00f4463fa79b", "comment": "Malware payload", "value": "4d1f716c5e1963fb3942dbc78d2f445d6fc2e140", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517556, "uuid": "470a9ef3-b7bb-40e0-921f-0b5ff4d2dc93", "comment": "Malware payload", "value": "2a1dd58287e4b65aa4fb569476f37e3f6bf03005e0ec14702408028fb6b52bbd3862bba383da75dee2284233ed8843af", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517556, "uuid": "b0d1360d-2f46-4cd3-b6e8-bb9a5dd8761b", "value": "T1EE9002401582573080E0443C86E73A4746E56100DF5190901E74D324D584A5F5A55950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517556, "uuid": "72024fb7-2bf1-4a20-b510-fcf9da98fd90", "value": "3:oNAbEBOQQ1D/se:oijP1Tse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517556, "uuid": "ee0f4331-1b54-43ff-a29c-f16ff8b5dd66", "value": 55, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517556, "uuid": "6553694f-8a17-447e-a1fc-7b52a0ea485d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517556, "uuid": "9672bfce-2c00-4ece-995c-f9721651f205", "value": "bc8de80a28c8ae55415ccdfece270f6548f067fc2a00e799baf0279d4d560807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818ab7b7-941f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645562357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562357, "uuid": "11d15c17-a95f-4b71-8efe-e75224b0134a", "comment": "Malware payload (Heodo)", "value": "4d203898411e0d1a8ef385109964c0f3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562357, "uuid": "a261a578-68ca-47e5-b97f-56b31375b7c9", "comment": "Malware payload (Heodo)", "value": "bcb8467ef098d62929e12828df4d40be41cecf37fd81ad1d6b92ff40a09e93de", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562357, "uuid": "1c07ccd3-d361-457a-bbd0-53a1a897a9e8", "comment": "Malware payload (Heodo)", "value": "7441f278288dc9b8048a859a43c114e6d06843ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562357, "uuid": "eb80ec56-08f9-4d3c-ad0f-cf33bcf488b4", "comment": "Malware payload (Heodo)", "value": "fd2d6fa0fe7bf7334f40158633e10d4766b7730a8dee488e8966a8cde8c8e6bd7818b3a46d6d60852c1c4c062db0b4ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562357, "uuid": "470cc7a4-abc9-40d1-a25a-025b8d3540f5", "value": "T13AA4AD21B7D0D032C2AE31746A16E3B56AADB93099F592477FC40B7D9F351D28A2834F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562357, "uuid": "e0ed571e-2258-488e-91c1-361fc9783df8", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562357, "uuid": "9644974e-6edb-4439-ad92-c8418f68e169", "value": "6144:PFdhYCryBe9NY/55YWAVtXWUVPlLX8IjMpz5yRs8IpqAiA8KQd5dhMYi7nwZJjIF:dPY8Y/7nctXWUDIpz5GszH2fTSRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562357, "uuid": "5d879c95-ae07-4787-a679-684b6ee0db6c", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562357, "uuid": "724eb320-7c58-4713-9ea7-bf55ef3ac566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562357, "uuid": "f731055a-a08e-4323-8b1d-dd54b0ea7825", "value": "emotet_exe_e5_bcb8467ef098d62929e12828df4d40be41cecf37fd81ad1d6b92ff40a09e93de_2022-02-22__203912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90765939-93ef-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645541767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541767, "uuid": "accc3b27-2ed8-471d-9a7c-d9d51bfc382f", "comment": "Malware payload (DCRat)", "value": "4a9f63c583d50e36a39068bddf935b9c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541767, "uuid": "0ecfb0b1-2cbb-4ae6-bfe3-e00c934c38f4", "comment": "Malware payload (DCRat)", "value": "bcede46445b13b3def4d8363b1365903a72f3ed6c09ff078bd3a090f65ed0937", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541767, "uuid": "b6fae508-68d4-4cf2-aa2d-45dbffaab412", "comment": "Malware payload (DCRat)", "value": "197c368ca818ca9120fddad555f717bd2813d9f6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645541767, "uuid": "295e6fe1-9531-4da8-bd5a-721391f8bd97", "comment": "Malware payload (DCRat)", "value": "64d5f9f063953fa4d3e5658ead0c1f575f33953f7ef2f816d929e0cb1c3dd62a2a94d70f319937281b744770304f18d9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541767, "uuid": "99222407-cb4a-427d-b5d0-0bcab36026f5", "value": "T1F2C533961AE587B7E0832371B8C5379C31F91A1A5F2310E7EB28504579217CA9BBC3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541767, "uuid": "f69573a9-dbb9-49f0-a6a8-db4c82a116da", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541767, "uuid": "a4bff1d4-6900-47c0-95da-8f786126d95d", "value": "49152:pZM4MVRmNoFEA5jyAEn3D5QNs1zvhhJHgfuO9ORz7f4d5:pZImyrEnz5B1zvviK7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645541767, "uuid": "bab05ccf-362e-4456-b815-9e4fd1de8dec", "value": 2602349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645541767, "uuid": "d1288919-a7de-4d65-9759-350b12c7f93d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645541767, "uuid": "21115e67-d39f-4a9e-bed2-9e02e12f5989", "value": "bcede46445b13b3def4d8363b1365903a72f3ed6c09ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c263cc-9393-11ec-9275-42010a9c0029", "comment": "Malware payload (DarkComet)", "timestamp": 1645502282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502282, "uuid": "88b248ac-f03e-4542-b07f-8ddb2db383a7", "comment": "Malware payload (DarkComet)", "value": "cb073f794527f5a36e4472177c29d16f", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502282, "uuid": "0a40d0a0-565a-4762-86e3-d164bc2ad381", "comment": "Malware payload (DarkComet)", "value": "bdaf3fafd08042efba5b06175014935c0614da56aceda8464a8857351cdc21cf", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502282, "uuid": "50e32730-6fb7-463a-b814-261e49d824cc", "comment": "Malware payload (DarkComet)", "value": "863966c52dbd03751ad4231360c672867be6ce52", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645502282, "uuid": "953dc957-ce4d-43a5-8a24-12f56b306514", "comment": "Malware payload (DarkComet)", "value": "5ed5f5fde8bb74e3bb7171d6796ea62dbb2441b6ade11645b0a3f4234f0ad71b71d8918a231c180599ed5463b6fa729f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502282, "uuid": "1cfa4270-6d1b-4e84-8b3f-ec78485d3a1f", "value": "T19A75F1583AAB5F3CF0B64BB658C0EC64BB69E7231C05F37EBD4025D6C692B408D52276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502282, "uuid": "d83656bb-2644-4b6d-9ea1-47f805dab1e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502282, "uuid": "6fcd9f90-0fe8-45d1-9528-9be55038bb92", "value": "24576:352N01A4H2uJyjKZMqpukZ29MdKB91iGue5gQlR/K9e7uaAvHUGDwUZhA:pJ1A4ZehqJZ29Mg1uetR/KwyHUwFLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645502282, "uuid": "83147d6e-3365-454b-a5a4-687e96179efe", "value": 1613824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645502282, "uuid": "f6861ff6-6edc-4746-84b1-95c873841d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645502282, "uuid": "39d440ce-0e8b-4722-b72a-c7a79ddadf26", "value": "SecuriteInfo.com.MachineLearning.Anomalous.95.21086.19065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca8a0d1-93b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645516501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516501, "uuid": "70533f09-ff0c-4502-9db8-25b79f348da8", "comment": "Malware payload", "value": "a5d742857899d27c63b4dd85c0df3ed5", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516501, "uuid": "b1863f81-eade-4057-9bde-e200be2866ac", "comment": "Malware payload", "value": "bdf27dd56ce246bd7cfe742f809bab2e78009c02c18c309afd73fd5f7ccc1178", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516501, "uuid": "565881f0-0bf8-47f6-aea8-e590c04f2458", "comment": "Malware payload", "value": "ef63284bd6a7a4f0f588f5401ed2e32e6ca0593c", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516501, "uuid": "29034f2b-abbf-4966-a93b-e42c3ec08aef", "comment": "Malware payload", "value": "d601848b7e358fb5bfd61d457fa53995c22c0a06b4d7e3d855e3303dfa9a9ca9007e591810c70f371ef3e7005f5e318b", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516501, "uuid": "b6eb839d-7a10-4d28-9f08-6ec060ec8bcf", "value": "T1EB23C02CC6415706C2635D3DC47C88E049A6EC13B116848FE5EABE8B1BE9E46274F7C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516501, "uuid": "00189642-67ec-4468-9233-85e02abb6b72", "value": "768:r+hRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTB:r+/JqHt7NJECQFfqAWUer1/K8NytsRjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516501, "uuid": "72a6ee02-6679-48b9-be42-3bb4d66006cf", "value": 48031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516501, "uuid": "0e321cd2-19c0-4c74-a6d8-fc010dc94107", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516501, "uuid": "25b3bf5f-e223-4902-83fb-770d837f066e", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5e7dc7-93d3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645529517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529517, "uuid": "2913a49f-ae11-4201-9c46-7791ecaa90fa", "comment": "Malware payload (AgentTesla)", "value": "cad37af87dd7fa7b28d097aab6f3e80a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529517, "uuid": "281ce445-7287-4f99-b7f8-bdc3dcbdfab4", "comment": "Malware payload (AgentTesla)", "value": "bdfb4f30c024cf240e289689000706f4271e399155bce4814a6846e0b9468a46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529517, "uuid": "b9b340df-23a2-4db1-9e6b-867b1eb08b16", "comment": "Malware payload (AgentTesla)", "value": "272f5aac459570a1783cc903cec6161909427e5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529517, "uuid": "2d5834e1-e1b1-49a5-9574-bfcb3a8d192a", "comment": "Malware payload (AgentTesla)", "value": "4aef54b20f6db4fc958095f5b8e9056d5f402862efe71ef76c80c40c985d04aa20cdfce116333e2f3c67d3e325a47251", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529517, "uuid": "c1b0108b-5097-4fd5-902a-33d5f50d94f6", "value": "T1F2355B9C365072EFC867C976CAA81C64EA60747B930FD243A02316ED9E0D99BDF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529517, "uuid": "d19bf603-c6ea-410f-a5ca-2ab9c7461db5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529517, "uuid": "0a6c061b-683e-4f23-bb15-7fce913d7b56", "value": "24576:qPGC1/kV5UlXNHfS/zyBGYveb1R1WEPD1:qtOSZK/W9Wb1RZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645529517, "uuid": "17b0b8ab-946f-41ae-a12a-7f0cbaef5b72", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645529517, "uuid": "334e55da-63fe-4181-a765-cf5be861f41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529517, "uuid": "c07b3be4-b001-4c77-91b7-3214bebc7ed9", "value": "OOLU2688028940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a5d834-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645539044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539044, "uuid": "f8bf2949-d3e0-4fb7-a2f6-9a86e41139b9", "comment": "Malware payload (AgentTesla)", "value": "8b6a877dcce5016c9d6f9c67900f8077", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539044, "uuid": "683ed877-04dc-4763-90ca-66fa8c1ac7f3", "comment": "Malware payload (AgentTesla)", "value": "be7625901999a283d7d72185a7b255df2f2635c23f8f59e81fbd14159e856846", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539044, "uuid": "b74a7573-b6b8-4f6d-8015-9fe5a15db5be", "comment": "Malware payload (AgentTesla)", "value": "6a77dc7d1c49b0cf22d1747f188be1676cd3ac9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539044, "uuid": "8b2368cd-2a0a-447d-a5a0-5ff4753605ea", "comment": "Malware payload (AgentTesla)", "value": "8efd27fdd94abb7437c769abffa006140a6f1b22129967dba527e3be873312383e62cab76981fbc7d7bcc1269a753882", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539044, "uuid": "e194ec1c-7030-4cbe-9e96-210f212ce710", "value": "T185357B34A7AB4F3CE0758BF649A4DA60BA54AD1F1C04A7AD3BC136C6C672FC1494A173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539044, "uuid": "b138a05b-bbfc-4520-aed3-40710a1320f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539044, "uuid": "986986e0-03ad-417d-b761-d8811e8a63fa", "value": "12288:5gB6AmNEh7jBX+e/c37d3rKjb3GP4wtB5XHftcWghX+iNFy3VD8d0oOp7NL5/2yy:SmNIIrMEJiWYOiNFyGq512Ux0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539044, "uuid": "866626af-c29d-46bc-89a2-85963b645e2a", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539044, "uuid": "17988d10-8d00-4a62-b529-a41ff03944d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539044, "uuid": "7cb64156-e1e2-4aab-a913-c2111249b8ec", "value": "WLCA22010024 - DRAFT PRE ALERT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfff7309-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528156, "uuid": "e7915fc6-b343-4a7a-9b8c-e0636c3bb20b", "comment": "Malware payload (Mirai)", "value": "74e6e16c417ff742645449a6940f019f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528156, "uuid": "5f99c3b1-224a-4c72-a396-9436a38fe897", "comment": "Malware payload (Mirai)", "value": "bebae509eb641f26368796339f7c54df84cb241b930c7b96c650f6f1847c5765", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528156, "uuid": "f4f8b395-b264-4b9f-8c57-df051d6c28b8", "comment": "Malware payload (Mirai)", "value": "45cbcfcd0b32c63f81226c7a5f092f1d5c399bc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528156, "uuid": "68566266-b788-46ec-8ee9-4c866cbbffd1", "comment": "Malware payload (Mirai)", "value": "b313f630b00ace54a26bdf4f9384433b21860858948af0ad7ed3dd4209e459a42a1d12f40ac665fb1b74764d48f8f3bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528156, "uuid": "3d21f969-1695-47eb-bf4d-20926b3aa29e", "value": "T195435B0273280A47E1525FF4393F27E083FEE99121F4F5892A0FDA464276F77158AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528156, "uuid": "7f2e7e30-03f7-4403-b5a3-9c6135a038fe", "value": "768:8YfPffzWfQuxL/j4oy9RTcEYyrm/EkCx7qn5yQCGEgvM3f/3AHtZAIsYslJxsED:8USfVj4oKJryE32yQTJvM3fQDsbxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528156, "uuid": "90281585-4ecc-4da7-8cdf-b78cc80f07e9", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528156, "uuid": "cfd7791b-9454-4d36-9154-3966697e19a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528156, "uuid": "4c393cb5-81ef-4b78-9f09-5624361d558a", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444a80dd-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531760, "uuid": "1d075459-b9cb-4467-8d19-1f73580ae4c9", "comment": "Malware payload (Mirai)", "value": "12cc6d10d21c281c0104cdb712cd8ae8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531760, "uuid": "abfe8d1e-f0c3-471a-a97f-5b4b2c0e4097", "comment": "Malware payload (Mirai)", "value": "bef9009f6fba90a4594506fa306ef6682a90bd7a08ae6522470b44f36a3c5e15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531760, "uuid": "6000df2a-e927-4f6e-bfff-9b333f2495e6", "comment": "Malware payload (Mirai)", "value": "169c754957708149b3c3fa37530abfa5049a8f97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531760, "uuid": "fd661db2-dac7-4dab-8ac9-288956d0d3aa", "comment": "Malware payload (Mirai)", "value": "e4fa53b3c4fa71b2d61634f6a4122e0417795a6083d7b1c39391b003972ae546b99a0567a4b9e628c6da1201bc7a8b75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531760, "uuid": "df819aeb-197a-4f11-b6ab-4988e334a88e", "value": "T11D83E895B8C18E11C5D413BBF92E018D331267ACE2DFB2169D206F147BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531760, "uuid": "36fa4ef3-fe1a-4c6f-8020-41b3b272306b", "value": "1536:uRnabgUZLKq/zB8dAm5UhNTzeRGq1SM2b/cc7JTKi6N1nGKYw5e5e995nZ4cuIfN:VgYLp/t815YNPeUqoMS/ckJGpN9NL0aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531760, "uuid": "73f2feea-fc0c-4b20-a452-9861ee791deb", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531760, "uuid": "306057e6-90a2-448b-aa59-ddeb0f5b005f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531760, "uuid": "635ccc8b-034c-4a86-943d-abf7a97ef59e", "value": "vcimanagement.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5be4225-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550473, "uuid": "39177a7e-335e-4fe1-ae2a-376867581ffc", "comment": "Malware payload (Heodo)", "value": "a38253b13d587b1bdda28cbcf1502411", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550473, "uuid": "9ae54c1f-4a26-4dfc-8f02-cd43b1a30e41", "comment": "Malware payload (Heodo)", "value": "bf16a70b307dc21c41b1d1e2395c7900433269c15b7227d79e57b3b8914c4abf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550473, "uuid": "7b044364-e4e7-4f3e-9786-8e1d1a3a4052", "comment": "Malware payload (Heodo)", "value": "5f0c816c8c4dfd80c4134965b13b8a426dca3cc3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550473, "uuid": "21cdd1bf-fdf0-44fb-9dc2-372c6ff37908", "comment": "Malware payload (Heodo)", "value": "1923d0d76598c1a95bf839677d280d371e746a12dc0cfde7530592bef3e9119d9878f93a78f7760937fde3b4a24f8cd7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550473, "uuid": "08440c51-6f87-4986-b4ee-14c591be0d4b", "value": "T1ACA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550473, "uuid": "3dc7fc02-4f17-4c48-8b45-3c8a6716979b", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550473, "uuid": "704f3baa-68a9-48fc-888a-07f8273e1efe", "value": "12288:vicw4w2Vb0zq6k5Z2mTujqkGXNrGHORQuBT:viSwub0W6LmT6wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550473, "uuid": "dfe7789b-2567-4017-9664-465af75f246a", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550473, "uuid": "4efec2af-7a4a-44e4-be42-1edf72c97a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550473, "uuid": "78e4e1b1-4dde-48ac-b1b6-a90b2cd6a138", "value": "OjmCnyuVMXKr9U3Vc2upIZHbiOu3jVXKf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f389d892-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517452, "uuid": "ae3f3ec1-fa62-471a-8345-5fc67f5c6be8", "comment": "Malware payload", "value": "82b6a78ad593b22b04280077608f291d", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517452, "uuid": "bed92de4-7a45-4520-8faa-182a1f82d7f8", "comment": "Malware payload", "value": "bf3529c3d7d27a23db406da1cae1ab04e4b0c5b14de4aa69d5bb11166e1e5c1f", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517452, "uuid": "aa841ce3-5d1f-465d-9eed-36bfd241ccf8", "comment": "Malware payload", "value": "8b319a0321cc933f7ac0d8befa99d158cddf33ad", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517452, "uuid": "04869528-9a89-4bd2-bf26-28df73bbc8ce", "comment": "Malware payload", "value": "e85ee88ef498bd64b8f3148e74cd7f64868829756862b674c057ab5f98c4668f74fd5a54dfcb4d43817b471935f548e7", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517452, "uuid": "909b3d04-b666-41ac-990c-d23c3f5325be", "value": "T100C47E57F7DBF6B0E6BE827A86F1851C52B774620260A78F664072886D23392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517452, "uuid": "039d5cab-3356-4519-9a7b-82f7784200ab", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517452, "uuid": "3d8e0b7f-e165-4f5b-ae87-50d1d5678ab1", "value": "12288:Un/zDvGHAykH8vLW/4+8bzbBSreMdOBY4ZyrE7K3yl8PeVooA/AB2LEJZ4AQPUqj:2zbGHAzHKjX1ZBY4ZyrE7K3yl8PeVooU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517452, "uuid": "a7571d8b-5e0a-4415-ae95-579d44068b05", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517452, "uuid": "77e93726-3d26-4f38-94f8-b8f82ae46ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517452, "uuid": "8e52c042-ed7f-4448-9174-7ac9264b1bcf", "value": "Specs.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7398180c-93c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645524109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524109, "uuid": "058e5721-4c6c-4065-88a2-d4500920855b", "comment": "Malware payload (Formbook)", "value": "62cd869fdf410d59c39d40d52dc524cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524109, "uuid": "4743f52f-f8c6-4920-a60c-d1b7a11977f1", "comment": "Malware payload (Formbook)", "value": "bf9947c6aff5ae8782f98e274a318d36e63c1a95b822ecfe809c6299d26b07b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524109, "uuid": "9f8445e8-c524-40bf-bc74-197939abdb8d", "comment": "Malware payload (Formbook)", "value": "4d9659c4374c9326a770e848cecf4679d802b547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524109, "uuid": "b9f88462-80fe-467a-a801-e68a8016b4c6", "comment": "Malware payload (Formbook)", "value": "e8500c66d1c946987c71074432505b1d52b524891ca9fc75c11931c9919d7b6f9a144e551a8a9a965d72afb586a62c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524109, "uuid": "2bdea88a-a689-4b59-be55-9aed18b1372c", "value": "T1AF4401B154E487A7E4970E30C43E772EE3A1DF64112A1A03E76C3F3669F6683944E289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524109, "uuid": "0d8aa9b2-dccf-4198-8171-89dc0d09ab5b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524109, "uuid": "df0b51cd-e690-4a48-989c-aa4c7df4fc59", "value": "6144:6xDztULg30y7kV5M6Epba61k7TBJ/GkQbnvLUOwym:Mx/y5beG61kvykI/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645524109, "uuid": "67cfc698-0558-4e8d-9525-26dd31f5e840", "value": 261526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645524109, "uuid": "6b05640d-2dfb-4144-9f47-325c8981a9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524109, "uuid": "6c7a5dc2-cb7a-4b61-8098-3d0f57cc9704", "value": "\u0e43\u0e1a\u0e2a\u0e31\u0e48\u0e07\u0e0b\u0e37\u0e49\u0e2d\u0e43\u0e2b\u0e21\u0e48 (\u0e2a\u0e31\u0e48\u0e07\u0e0b\u0e37\u0e49\u0e2dFF1197Q) pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083d6815-943b-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645574180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574180, "uuid": "73eb7699-0bd6-4dcc-bd63-6389ab2faf91", "comment": "Malware payload (njrat)", "value": "bd146087611abcd95cb65720e362a5c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574180, "uuid": "62d8e5cb-ef1a-4621-b45b-d96942f03711", "comment": "Malware payload (njrat)", "value": "bfe59c93f29b158055b230b51abfa92276519a307bcbf940a29e1fdbaa150bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574180, "uuid": "5f9b0a78-3913-4e00-87c7-3ef3be94f419", "comment": "Malware payload (njrat)", "value": "df1f9efd5e89d42552397425daaa87456299f792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574180, "uuid": "7f626727-1341-4dfb-a893-b8482423e8e7", "comment": "Malware payload (njrat)", "value": "a077ec0be267564fdd1caa9755f775cbcc6fcafccd21937b99caeef72d481f4296f407abfc77664a4c002156cf74afd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574180, "uuid": "744d6b9d-3804-4afa-802e-d07b6b2d6887", "value": "T11EC2D1935621D632C8228FBF5FE393A0A0E0D62A35834C211A9C0D5BFDE21DA4E7B350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574180, "uuid": "c43e4165-398d-446e-90bd-ca8866c990d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574180, "uuid": "a32fbc0c-8cfc-4e60-baa0-915ba100f971", "value": "768:svpzN0lUu9/fWJtYxyiEs8rsByMX2CuCN:Q50Uu9dyiYYByS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574180, "uuid": "6bf2254e-9bc8-480e-b639-4cc1b3dd530c", "value": 25947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574180, "uuid": "f6318a81-3d30-420c-bf8b-b3a5b4a6e6f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574180, "uuid": "6163a93f-aa47-41b4-9df4-0e60af02153a", "value": "BFE59C93F29B158055B230B51ABFA92276519A307BCBF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27e5c27-93d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531086, "uuid": "cf5e2345-9b86-4e43-bfb6-f0eb9e220c30", "comment": "Malware payload (Mirai)", "value": "64195b1f69d00879d5773206b247d429", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531086, "uuid": "6ae04133-40e9-4074-b91c-113596e95669", "comment": "Malware payload (Mirai)", "value": "c05c181f35b4a0956df4d7343709063b8e38308c870a88584236ad9e8c96e34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531086, "uuid": "4651ab15-f3b5-46f5-ab75-f67e2991d44a", "comment": "Malware payload (Mirai)", "value": "67689764c9c5d1faf0aeb95ac1816f7d53d25eb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531086, "uuid": "b8acffa9-a0da-40af-a53c-acf23b22b223", "comment": "Malware payload (Mirai)", "value": "9c5aab1b36e6c850fcfcadda17414a6484ff49cc732198b3f29465503eecc5f3e7f99551e254b02479f061742440379a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531086, "uuid": "00092b96-9856-4351-8e3e-7b7eb87316c0", "value": "T19353F80AAFA10EBFDC6ECD3310DD0B92248C961B72A67B753534D918F64B54A4AD38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531086, "uuid": "f0c16a98-1667-4fc7-8ec3-f1f0ddc42df3", "value": "768:dLL/2sj4V2NL0Tn3tbU73uKvTEbZ1t0oeLXif6XXJ8syni0YvspF:tLbj4ANL0TnN83vYbZ1t0WWXXeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531086, "uuid": "65839f89-07bb-4a29-9126-13abbfadfe8f", "value": 66052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531086, "uuid": "2749c9fd-56f4-484e-8c70-e59a03e06a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531086, "uuid": "19f05025-1c30-48bb-a410-4096fe879310", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c2de3f-942d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645568539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568539, "uuid": "fe86a407-4723-4720-a76e-6f9fac84199b", "comment": "Malware payload (Heodo)", "value": "6ac6ad076d6ef4d2d9ccb126b9e078fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568539, "uuid": "a740c5c0-c04e-46c9-83bb-3e7d4b6dd4d7", "comment": "Malware payload (Heodo)", "value": "c101f5a10d776800a91efea1fab9232d413a32169e09547db5335ef7f4bf2781", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568539, "uuid": "4d7028b8-932b-48b5-9d92-13cfc2824bbf", "comment": "Malware payload (Heodo)", "value": "d36a8272007c55bf8dd12f4c2227b8c3502af8a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568539, "uuid": "a9ad3ddd-895c-4e3d-b512-ee1319b52e5c", "comment": "Malware payload (Heodo)", "value": "59ecb5d8f98bc639b35d6aeb5ca30900c8c9eff1c22f6a7f32bf30b596012fde97b052e100eec54bccca8d47c8097da4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568539, "uuid": "9cd73da4-79e1-4a27-bd69-0c95e2540353", "value": "T1FEB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568539, "uuid": "954e2942-a5aa-401d-922f-2dd121a5bd42", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568539, "uuid": "0d09b024-846d-460b-94c0-5507edcfd3ee", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wYIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWHzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645568539, "uuid": "9708a328-c90a-45fd-8d28-ca51dc50bb39", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645568539, "uuid": "feb1801c-e3a2-4e77-a2b8-e39cb536aada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568539, "uuid": "9b2c237f-2ce6-4ab4-a7f7-6d19671593cb", "value": "6ac6ad076d6ef4d2d9ccb126b9e078fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc74203-93d3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645529708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529708, "uuid": "84f16d24-a4df-48fe-a1a8-412c83b47e8e", "comment": "Malware payload (RedLineStealer)", "value": "8697424b438b0fa848737b2ec1b55e50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529708, "uuid": "aa756939-fed5-4514-94bc-ea5e0efe9bfa", "comment": "Malware payload (RedLineStealer)", "value": "c119d0bab75794fd6f36e8a3a790af438a9fc32a0c4573f206542cb4c3989d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529708, "uuid": "f623528b-86da-4623-a1ae-106a6128fd6a", "comment": "Malware payload (RedLineStealer)", "value": "a0c5cb15b54991abf27d72163cc22ebb07aa47ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529708, "uuid": "b023373c-c2be-4458-812a-35b6306e9919", "comment": "Malware payload (RedLineStealer)", "value": "ad557ce8a14ee7a237eb90534246f6003404b095739f140a8a5c710830fd6b7700e4f36e8f4d3f36bc24b4a222795a3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529708, "uuid": "96710c42-31bf-4ee0-b418-5d79aacda6af", "value": "T1B83633EB3F047812C09B98B520A5F655CB32822576C4C11D9B9E67DE9BB2C8FE43914F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529708, "uuid": "dd6ef9f8-d9c9-4cd4-b2ff-f475c1e6b55e", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529708, "uuid": "42f47d87-821c-46ce-8380-defe374ceb2b", "value": "98304:eqeUNCcurwyjZJ2pcnO0AgMhXJU0ri3VtCdb9Jufh//yrERF:ecNCBr1ZJKuLv2rO3Veb9JuJ/KrERF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645529708, "uuid": "840f002b-ee15-4d68-aef2-ad79d7e591ef", "value": 4867888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645529708, "uuid": "5565ae5c-4f6c-45fb-8841-b6408f7ceab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529708, "uuid": "d102ebf2-b8a1-4729-9c97-ac8c9a586bde", "value": "vegas190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fa1f07-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554963, "uuid": "b8aa0891-e332-4e2b-ac42-dd51a12eb7fd", "comment": "Malware payload (Heodo)", "value": "ed0d1649fba90cc17c910588fc004f61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554963, "uuid": "da5afa9c-5c0c-47cd-a324-f4bb2c626312", "comment": "Malware payload (Heodo)", "value": "c16ce7ad663b1d69a698b39cc16cc72bcb60b6babb8804789807ee761245b2b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554963, "uuid": "aa6d8d4b-fc22-4138-b2b6-cb11538db2ef", "comment": "Malware payload (Heodo)", "value": "f56dc97bd96f108047f5cf7ac95d4b9f5866b482", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554963, "uuid": "54b04496-8570-4a7c-b48b-9ce5f25812cf", "comment": "Malware payload (Heodo)", "value": "e2da16a8a371c192e5ad4685b209667dc49792492512d9f632104f003c05ce9505d59d7c85e57df5b518d9cfa2f62311", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554963, "uuid": "6684ea25-7aae-4748-9270-14949c876234", "value": "T191A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554963, "uuid": "634e047b-1624-4855-871d-91cd10045993", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554963, "uuid": "41ae7b8c-4552-48fa-a6d9-b879d33fb08b", "value": "12288:vicw4w2Vb0zq6k5Z2mTIjqkGXNrGHORQuBT:viSwub0W6LmTQwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554963, "uuid": "2311ceaa-43d3-431f-b34f-9ec7e10ecfa7", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554963, "uuid": "f3794305-1004-49a9-b31b-9946110429c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554963, "uuid": "ee5a4d0e-096b-4d7f-816b-0379572666f2", "value": "ed0d1649fba90cc17c910588fc004f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30db1171-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555780, "uuid": "7c3121a6-840a-4b1f-80b1-4215868a7bbc", "comment": "Malware payload", "value": "ef0f76b1980df5f92a1ce2d3e3f6a58a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555780, "uuid": "d0ac0d7a-26d4-40d3-b6eb-cdc8111c3ed2", "comment": "Malware payload", "value": "c16da599a43c08ba0334891b83135ae080bd70c7d68c58d5de48224c6e08bbba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555780, "uuid": "4cabb8df-b3e5-4f99-9958-b18a0dd4c4fb", "comment": "Malware payload", "value": "f80fc4b8e0767091c98b6ca617ebfb232c4a33c2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555780, "uuid": "aeea433a-d3f5-4c3f-a617-fabfb997bd10", "comment": "Malware payload", "value": "ba5d371897e9f77fa8ad3564b415cc1c4c6642e2107011a822c676a9665b78d8d26a1a259d5053b80ae4a9b1f5e571b9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555780, "uuid": "cc0778a4-e998-46c4-bd8d-3414014628e0", "value": "T1D6C2D037A540BD31C5935E7D90DA08F2FA394E47F26826D10850F1D85B59E0B5F762A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555780, "uuid": "3f11f5f7-23a5-42b8-bcb3-a95457849143", "value": "768:oij80ATnhBObTBfIkLlJKpnhbnptOTJKLL9V:oij8LnhBObKkpE7D30JK1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555780, "uuid": "4266a7cc-d1a4-44d4-bfbd-6f042e461012", "value": 26167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555780, "uuid": "c32bf74e-411b-41ea-807b-42e2ce78a9ee", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555780, "uuid": "828ecf08-04be-4d89-8548-ef959519c116", "value": "tmp7n_6jos4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16245523-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645538984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538984, "uuid": "e6bc5765-ed71-484f-a0b0-e6d3be43490f", "comment": "Malware payload", "value": "e94ed4a852579982dd5909852a14c033", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538984, "uuid": "a65add39-ef72-41e7-9d61-806613333e3a", "comment": "Malware payload", "value": "c1c8bacb9d1cbcef187da4adfde7761c91543e84223a37385fd5c25803e1d16f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538984, "uuid": "05157773-ac80-4864-9675-3f28fded9998", "comment": "Malware payload", "value": "d3de250863381781ea16d3501ef2b35034bab06a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645538984, "uuid": "eecd9083-4429-407d-9bde-edc5910ba3c5", "comment": "Malware payload", "value": "1440c87cb8a9fe92f98e963a44b3bc96824c206c5e3cfa2068ed13e6cf37d7d9a41da000f5f8e36438e5a6e6f243cb89", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538984, "uuid": "dc74e33d-071c-466c-b32f-27318f826dda", "value": "T15075B64DE7902BCAF0D6687CB61C33E99E970FF1097E6072E203588A26B12E49D75747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538984, "uuid": "6448cac2-5f7f-4a9f-b34d-220c0abe1fe3", "value": "84687bd7bcf9c6a61feea037640c3685", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538984, "uuid": "6ea24d0e-be25-4b34-82a2-0bf6d5b5fed3", "value": "24576:i+jyoF+mYqQ+7ddz+CJJGMeGD9ztBG2lqrsoEcRTneGjeBkQf/iDziQkJ4vLJ:i+jy9mYqQ+7ddz+CJcMrD9ztBjlqrJEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645538984, "uuid": "e79e9627-f87c-430a-a981-fd6e883d914a", "value": 1558227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645538984, "uuid": "0b336a50-1211-45b7-9014-bda2236db988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645538984, "uuid": "e1e43aa9-004e-4e4c-be87-7ef99ae18f75", "value": "c1c8bacb9d1cbcef187da4adfde7761c91543e84223a37385fd5c25803e1d16f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f157a05-93a9-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645511539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645511539, "uuid": "d4835200-c0e8-4b46-a65f-d731acfbec39", "comment": "Malware payload (AsyncRAT)", "value": "f316f7b21b5720812a1e6eee410328a6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645511539, "uuid": "f2fd0859-eecd-4f5f-b7d7-2906a61971f8", "comment": "Malware payload (AsyncRAT)", "value": "c25cbf0aabb0c1de1f9dd54df449ce9fb83649262a1345c19c17e21da21386cd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645511539, "uuid": "3271ed6c-c5f8-4f41-8b2f-35bb45490382", "comment": "Malware payload (AsyncRAT)", "value": "0cd04fd79ec5504b19059c21d6939ba7ac325adb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645511539, "uuid": "d4dbedd0-97ba-451d-a4b3-05b6e534b7b0", "comment": "Malware payload (AsyncRAT)", "value": "2513160b95f6855cedf357c6855235710d9f7e19bfd7af4a8ba91b72280133140d6a30f69693a735a7fce3a41069a47a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645511539, "uuid": "267b6e31-7cf5-463a-832c-5a50ebce4731", "value": "T1DA513BD7FDF8373AEF62353536AF46A28313BD216406700B1B6A33C4AC5B84C44818B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645511539, "uuid": "55c247bd-ad31-408c-b2f8-b73a7330e24c", "value": "48:9mSxJhPdde25FhEPOvtUB5FJge4YWEsCOBmhrF4P4YLHTZUYViGvV2p:ISxJh7z62vuFJgxYWEaMFqPzZfAGop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645511539, "uuid": "193cea3f-d599-43ff-b7c1-5a0418167351", "value": 2972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645511539, "uuid": "3a0efa0a-c663-4cee-b291-8443fca7be0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645511539, "uuid": "4d3bd027-42e3-4fa4-aa09-0f93fbe88c93", "value": "TQAPXOKRNLAWS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63219cdb-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555864, "uuid": "8b1fbbc4-c8c7-4dc8-bdf2-f090adef0167", "comment": "Malware payload", "value": "3029c30594edfd2f63ea3b5baf7cccc3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555864, "uuid": "25fbf584-52b6-4788-b447-dcd4232abcc0", "comment": "Malware payload", "value": "c28760a6fc74c4f7d2f07d331ba6b7c16bf4478523403a8cc7e06be59127be5f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555864, "uuid": "d5b9cd3e-0eaa-4c86-9505-ba3b5d0aa7f9", "comment": "Malware payload", "value": "15e349835b47d1bd625483e6eaf621d002e508c8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555864, "uuid": "3380cbb2-446e-432c-a387-7265f808f8b2", "comment": "Malware payload", "value": "029726af1f2b18e22dabb9b1ea90a271664d9bc696b7ae4b985a035109e0b5dc44b7aabed2b0e2725dd3640924c65077", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555864, "uuid": "1105a74c-dbe3-424f-bb99-505224ff3d98", "value": "T1A3930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555864, "uuid": "c47a092a-4f00-4acd-9d25-454d6695c23e", "value": "1536:Gyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQxmkWvgrPE4nWHPNc2Ad:Gyehv7q2Pjx45uoDGTj+5xtekEvi8/dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555864, "uuid": "f0e90234-d0b3-4930-9c93-40f074194b17", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555864, "uuid": "315be311-14c5-4ed5-9d03-b2bc27c689d7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555864, "uuid": "47cb7f41-88de-4a02-8e92-865182d95e5a", "value": "tmpit06x_m_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245eebf7-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517534, "uuid": "78578c29-01cd-40e5-8296-a40f510b38eb", "comment": "Malware payload", "value": "2b32ac5c9ad988e5eaab5f8b90ba0b9b", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517534, "uuid": "c8f54b8b-83da-4d34-868e-ee1f52f42029", "comment": "Malware payload", "value": "c305b3cb96a34258a3e702526de6548b2de99449c0839a9aea518accc7c861ab", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517534, "uuid": "c7aeb075-e18a-40cc-a3cc-103fe2023602", "comment": "Malware payload", "value": "d7c2eee2ff27f9a8f49c28b86dc0fc7f328058ea", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517534, "uuid": "213c64f1-19de-4908-91c8-6f8c7e539506", "comment": "Malware payload", "value": "583a4a237bc60e700438958335f50cfd639638de535532f0e57aa937c17737aa82558d0c118e0de0fa192b3ff3f48595", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517534, "uuid": "356b3b31-c1e5-48c3-9ea3-312323760205", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517534, "uuid": "cadf66c4-116a-45b8-8a84-cc42056f722f", "value": "3:F2cn:gcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517534, "uuid": "11539743-e1eb-49e3-985a-6ca6ad720b9e", "value": 8, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517534, "uuid": "c92b65ed-e8f4-42a7-83ea-b45385bc1bff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517534, "uuid": "e8c3aea4-4934-4c13-8d97-c6e255ece3ac", "value": "c305b3cb96a34258a3e702526de6548b2de99449c0839a9aea518accc7c861ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9b3ce9-93b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517091, "uuid": "c57c7b6b-8ca3-47e4-b0f9-25a0e9f98a1b", "comment": "Malware payload", "value": "e714970fe53214073147a763ca33b2a0", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517091, "uuid": "6cd6c2c5-aef3-4cf8-b7fc-12f6579b3836", "comment": "Malware payload", "value": "c3318d10e34ace5e6e4b1d96c154221d39bc872751641d5b04fb3e96c08d8cb4", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517091, "uuid": "5cd04296-81b3-462f-8e15-1a15b4444a64", "comment": "Malware payload", "value": "1d107042b3d93b6bffaab9fb142cbebbed86ddc3", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517091, "uuid": "25932944-8728-49d5-8b4f-2e61ea661505", "comment": "Malware payload", "value": "24e16ea4df1e667dc8e872512a27abd214fde68e31cf5a8bad8b0a9fd4d3668510dbebc830b1d2cb9d10546acf271af3", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517091, "uuid": "76e28fbf-10e2-4951-ab10-2db854be8f43", "value": "T10E23C01CC5512753C6B3293DC0B998F11A668C13A115448FD5EABE8F0798E9B274FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517091, "uuid": "c30c7fda-5d20-47ee-9c9b-f76f825c4788", "value": "768:VRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTClp:bJqHt7NJECQFfqAfDwmkyRLOMhuLpN1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517091, "uuid": "8b6c9c87-0b49-4928-826d-c898e870a500", "value": 48010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517091, "uuid": "42d5cf46-2057-4d99-9056-f0c82a7e0a70", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517091, "uuid": "e1156906-7726-43eb-8485-6c30703b6df9", "value": "IRQ2107799.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f79871-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1645514092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514092, "uuid": "48f1967c-4c8b-413c-80ab-a433381d66fb", "comment": "Malware payload (Socelars)", "value": "cec977fcca8285346e7a3744ecfcbd57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514092, "uuid": "58741724-7f95-4822-95b6-61072edf674e", "comment": "Malware payload (Socelars)", "value": "c3765f403341222a2b3c5be575ab72770b64d51e138cd934aca6dd3ea472cf0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514092, "uuid": "b73586c5-6ed0-4afd-9e36-ff25f3474ac2", "comment": "Malware payload (Socelars)", "value": "02213fde2cb6c5678caa151f52f3d73895c4d557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514092, "uuid": "42431651-bdde-42ab-b107-2a3fb2ec7d39", "comment": "Malware payload (Socelars)", "value": "801c93ac878dbd1b1e96421f0b22d0511bac6fbd17ab788651ecd4b2e22761cf0d733730c2474a6ded090fca85cfb6fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514092, "uuid": "d39c4d06-ef1e-4fa1-9ae5-cdd0e23c3b27", "value": "T163658E11F642A036ECE3007286FF4AFE8D287E21431894D7E3C47D695E715E27A36A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514092, "uuid": "b136f2a8-724a-466c-8459-8e28f144408c", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514092, "uuid": "ca4ff549-00d0-4e61-8dc0-4c2855e319ee", "value": "24576:JmpzgGd5UyylnSF99NfqLi+gJmssUZ6wEi5nLYyFqAyvNM:8plDlmBvIp5nLYyF1yvNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514092, "uuid": "36bf0c96-7c94-4bd2-8135-e4ffe36ddca7", "value": 1491456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514092, "uuid": "67d9f43f-60da-4ae8-b543-7a056c7a551d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514092, "uuid": "ec168069-8c42-410d-94d2-62e4f42fc565", "value": "cec977fcca8285346e7a3744ecfcbd57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe08701-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514868, "uuid": "023438a7-6f01-4c48-a352-4a2c49198fe1", "comment": "Malware payload (Formbook)", "value": "1fa274676dbdf091f9e67d6575258a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514868, "uuid": "52d3d99b-5333-4735-9d33-5754f5e2d438", "comment": "Malware payload (Formbook)", "value": "c3e4c2e1e242cf92142f4d4fb1896354cfa07089f40243b31046ff3eae8ac2c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514868, "uuid": "21f8dece-83a8-4bc2-a643-b0c2ed956c60", "comment": "Malware payload (Formbook)", "value": "938024a9f69606796254d6b8c0ec941cd2dce1ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514868, "uuid": "4f00226e-e56e-4710-9f3c-cbab0df52d0b", "comment": "Malware payload (Formbook)", "value": "49eac6801b6d361b69c09c0c45f382bccc9dcbbbb204e614f5b45ff1dc55454bd5cdca6fccdd4e69a908654c404394cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514868, "uuid": "5ca331d5-5c1e-48d0-acb8-7a8ba798b737", "value": "T16B15CF143AAB0F3DF0B94BB248D5DC64FB69F6235C09F37D785121D6CA62B408D826B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514868, "uuid": "9ba4d553-ae06-4e0c-8fca-14704dc2c9e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514868, "uuid": "3106bd8b-9f2a-43ac-be9c-68a841afc1e9", "value": "12288:fgB6PVQNAh7j3mWPjIKLPzL2Cq3uR/m9BFwuQDuKxBaU+XhHQIZLrEtP0XSiHL:TmNNkJL7LVCooBSuajubVJZMtcii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514868, "uuid": "25e05c98-c6fd-4abd-9192-d27b9f3a002f", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514868, "uuid": "cce02402-0a3a-4d2a-86aa-69615bf31ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514868, "uuid": "285f90ef-9252-4007-91a7-e0f2edcf5dbe", "value": "\u0422\u04e9\u043b\u0435\u043c\u0434\u0456 \u0440\u0430\u0441\u0442\u0430\u0443.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befef871-9401-11ec-9275-42010a9c0029", "comment": "Malware payload (MedusaLocker)", "timestamp": 1645549576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549576, "uuid": "7d1def6e-621e-4832-b2c8-6d2ced835fd7", "comment": "Malware payload (MedusaLocker)", "value": "fd9b18f720c9c48d0088a00afa6bb87f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549576, "uuid": "b5106cac-930c-43cf-b8f3-192431a5abf7", "comment": "Malware payload (MedusaLocker)", "value": "c41926a4e667a38bd712cd8fff2c555c51d7f719a949c9be8c1f74232100444b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549576, "uuid": "964c573c-bf30-463f-9399-c6f1543f5858", "comment": "Malware payload (MedusaLocker)", "value": "94ab2446ca9dd148e0f2d32247a450791b01adbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549576, "uuid": "589f93f9-9879-4dc1-89c0-5c530f564ab0", "comment": "Malware payload (MedusaLocker)", "value": "7f011e94ee9caeb2f9ff02a012b499dec6e63a228e957350bc6cf843faa097a38b9bc60ba7f95b08e20c0154c59bbf10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549576, "uuid": "1b94d20b-cb87-4cd4-a292-9e557c73e55f", "value": "T184A45B3E76ED05F9E07BE1388D932942E6B67805033087DF0394566A1E27AF5AD3AF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549576, "uuid": "04fa98c1-0a72-4d8e-9f40-1c2c8ba4c596", "value": "34d3cfe59cf0e09bc867b43bab6fa814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549576, "uuid": "0c4e040e-118e-4290-9afe-b9f2306afa62", "value": "6144:vE+MVrAQU3V1jWEaFt7Ka5ZrP0qwTA39RNxCjRp/FGyZ91DHtdTBJZEdjDMr:vE+I3UFVza5ZLMTERa7N5Z9ttdTly0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549576, "uuid": "fa2b00fa-d621-43d7-839f-0df50dc9f924", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549576, "uuid": "adf2c790-624a-435c-8c35-8e0744876197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549576, "uuid": "897f062a-4f53-4326-93eb-6990465d848f", "value": "scpvss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b24f6d4-9405-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645551046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551046, "uuid": "4bc5090c-2519-4fd1-8b3f-c44c5ccaf6f1", "comment": "Malware payload (Heodo)", "value": "579c2f6d46596faf4a2d492a954cac29", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551046, "uuid": "058ed7e3-d9a0-4418-abd0-3f6bd0843774", "comment": "Malware payload (Heodo)", "value": "c4531347c02ad48f5d1f2471aad72edcbeeda910dd5a0c75e0e9fc4c9d42dc92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551046, "uuid": "3ba23fd3-d327-457e-9746-71e21f919738", "comment": "Malware payload (Heodo)", "value": "bb53f0e3cd96c5769893e04696769c0910cbd958", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551046, "uuid": "164e4890-8c9b-4986-8560-76f75f085a8f", "comment": "Malware payload (Heodo)", "value": "f275f371926b5388e36727e84f7d165168837515bb8726f722bf1ce6e9dec5aeaee33543be360618ff89c53a036fd809", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551046, "uuid": "7021f00f-d66e-4732-b8eb-f7bc7dae7d6a", "value": "T104A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551046, "uuid": "25a5234c-f5b1-4f25-b8c3-e92a2ac78a5c", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551046, "uuid": "f3ea97ab-f911-467f-ba4a-ef743b97b5b4", "value": "12288:vicw4w2Vb0zq6k5Z2mTXjqkGXNrGHORQuBT:viSwub0W6LmTBwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551046, "uuid": "bd57a022-b552-42b9-a8dd-ecb58b32f505", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551046, "uuid": "6b99d34c-1013-45d6-983f-9e7ac118c240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551046, "uuid": "a045dcc5-57e0-492e-9a93-34fc813d8e2e", "value": "cHed6x.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b736a45-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555797, "uuid": "c3c24277-7c65-43d8-a0e0-5758baaf8670", "comment": "Malware payload", "value": "ceb7e2b24eaf7a00a056a7762f26e6ed", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555797, "uuid": "0d075ca5-39a8-4b61-a56a-0eb4ee4811ef", "comment": "Malware payload", "value": "c4ea5260566fabd5a074f713cde0a5ecf2073c99911b0ff8c9c9dc10f94a280f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555797, "uuid": "f7aa5d5d-b2c7-40e5-8ade-5cf788254192", "comment": "Malware payload", "value": "4ca350f875a73531bba6cb56e4171d624ad74420", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555797, "uuid": "df0e100a-8a5a-461a-b79c-98b1f0cf06e1", "comment": "Malware payload", "value": "b22391859188651e4167537b3007b23cb34750aa026a2dbe19ae2a0b757bf67e16e1ad6cf0f7cf6f23357ada46c5aace", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555797, "uuid": "71d285b2-55ab-4690-8dbd-adcdec14affb", "value": "T1AA13E03CCA481464D1A70A79660818F9FB9CDE43F1807BEA659DB50D8FC10CF8B5BAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555797, "uuid": "efbe784b-3c21-452c-b91c-ed4cc213303a", "value": "768:tkmb5E6IdOaIE8otUCs1A9PRXiiyQrh8BRh7beg91ELDN3BPuXe:11zIdOaaoblRXii1mrbekGN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555797, "uuid": "d2fe12da-46cc-4ec4-bb7a-ddf06f34cb49", "value": 44264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555797, "uuid": "f09b1e7c-4562-46a8-a189-429c300ed54b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555797, "uuid": "b127dbb9-977f-468b-b5ea-4af125e215b7", "value": "tmpcerl8i6w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d3b1a7-9374-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488758, "uuid": "a7dd5d31-1ebc-4f64-bd89-8028760b064e", "comment": "Malware payload (Mirai)", "value": "1b254e41cd65287d4c972a0090fd9718", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488758, "uuid": "5c9d2a8e-39b7-4362-b787-3df00b245461", "comment": "Malware payload (Mirai)", "value": "c53b6c8a42b05078bfcc76d49ea968b290094d08c669d16f7f0acf16299d7d23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488758, "uuid": "971927c2-5ec5-4d21-b0e0-802c0dce186f", "comment": "Malware payload (Mirai)", "value": "4c00d0173c8388111a0dff0106b633db62c0e840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488758, "uuid": "a7ffd2c5-2851-4e62-85d8-38bad71ff52a", "comment": "Malware payload (Mirai)", "value": "c78b98a3c30135356ed5fe53108b079e22c9f9774fe51514b009b1627668ce0fc1bf23f1f54472e7d932d83718e536cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488758, "uuid": "4faa76a9-87f7-422a-a455-e84fd486ba8d", "value": "T14FF2F1AFA6A43F97EFDC9C7EA4DD5302A140E356300E5E1C97060857D7AE14B79CC528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488758, "uuid": "07bbd645-4c65-4578-8752-befd59b8f39c", "value": "768:XGAtKfo4gUGvWLnGVAGu5gkH0HhsHg3WMF:XpQffGeLTi6oeHgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488758, "uuid": "54a39198-a348-42f2-bad9-afb088d67e74", "value": 36348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488758, "uuid": "5111dd41-eba0-47aa-93f4-8ad1c0efd521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488758, "uuid": "b719c95a-df59-478c-8816-12744a3d9b0c", "value": "1b254e41cd65287d4c972a0090fd9718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d656eec-93c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645523078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523078, "uuid": "65f0f243-70b3-460b-a3e1-9cb1a4a43707", "comment": "Malware payload", "value": "14788245b991a6dc225cd4a339a1f98c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523078, "uuid": "0f35f2cc-6c31-4f5e-880c-97772c826fbf", "comment": "Malware payload", "value": "c58da4673079768ff5c49bd1cb2d44a2d406858d1e2e4e61e99f199e4f01d848", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523078, "uuid": "dceb2f4e-248e-4380-9475-fba252cb0258", "comment": "Malware payload", "value": "e9e5a589ce53ed961cc37b7c78b1005232d0c26a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523078, "uuid": "4014d929-3ec8-429d-9529-383e4359a8f5", "comment": "Malware payload", "value": "904fe3a4c42fb8f019446823adbd0848576149341f6329e605eeb952bea579b1a460b6a96767e3c58322537b45315678", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523078, "uuid": "abab9a80-0b82-4a71-a4b0-0a748d2c1d17", "value": "T100B26419EF554E77DC2FED3345A90B8535CCA00B21A5372A3574C82CF26E9474AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523078, "uuid": "a4fa7184-fc0c-49a6-9ec8-030b78954500", "value": "384:cTnlut4xMnofh/K3vfPHZUrpCCuXikA6xetZ57qeOc44hPgC:Ylut4ynCqvZUANXi72etZ57qeOc3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645523078, "uuid": "51c43801-9cf0-4014-87b6-de2655dbbbe7", "value": 24268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645523078, "uuid": "c1c5b4cd-23e7-4317-861e-8afebf275a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523078, "uuid": "4df227ee-d120-4f27-afdc-00a76a1d1435", "value": "14788245b991a6dc225cd4a339a1f98c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c161b34d-93ea-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645539701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539701, "uuid": "faae87dc-00a1-46e4-aea9-724cd65f06a4", "comment": "Malware payload (AveMariaRAT)", "value": "a30feca6445106a8205e9eca6f225c40", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539701, "uuid": "85c93063-e00c-42a2-b6dd-7044ba609feb", "comment": "Malware payload (AveMariaRAT)", "value": "c5ef3509b03962939620c78c900260f4308673965268ccf659736192d9108224", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539701, "uuid": "c41528bc-51a0-491e-a98b-5a9c5fafbe13", "comment": "Malware payload (AveMariaRAT)", "value": "0450f70d122fe8a4c13dd65c85ba316df820d2a9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539701, "uuid": "4bbe816c-d41f-4476-8b4c-bf8aef5c7bfd", "comment": "Malware payload (AveMariaRAT)", "value": "e53bfa9a9b623cdc443ecfd6904858bb70eb2369cfa0f1436bd888af95ee6b447591b5411a42534972f3d09276eebaa2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539701, "uuid": "a0b34771-253b-4107-b585-eef92ebf6ec5", "value": "T1EDA4029A7B42FDF7CCA48431911382D2AB22AC3D9E51271A67DDB3BF797A181D332105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539701, "uuid": "357ea84a-2d05-4af7-9f65-5b966415572b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539701, "uuid": "4f90be5c-307a-4924-94c5-40123f0471cd", "value": "6144:cxDzyW68yGvcGG+J3gaLg+E60MuvDM8QQmWvAcYZeEp3WBl6pfbhuuNKST:nPdYwaLgHNFM8eWv2ZFoB4VJNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539701, "uuid": "eec38b92-0e67-4d80-9726-bc9d443540db", "value": 459628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539701, "uuid": "b288e3c0-708a-4508-be1c-3de31043b160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539701, "uuid": "e97e2df0-3705-4866-8e87-056022021899", "value": "PI-0222328....confirmed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a3cae3-93a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645510831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510831, "uuid": "dfce9f31-043b-4cad-b7dc-479edb5e49f2", "comment": "Malware payload", "value": "78c058e12814dea6de41f4f526912629", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510831, "uuid": "70201473-7c9b-47a1-8751-d7c94db18539", "comment": "Malware payload", "value": "c61b6512d455398c2ff7fa4450c488e7eaeb8aacc01f732d8204ae302e2cc868", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510831, "uuid": "434406f8-b6e1-4842-a403-a85bbeed8be1", "comment": "Malware payload", "value": "fe8c98005af832f0f58bab23b2d3d11b9c6f3a45", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510831, "uuid": "41b4ccfb-398c-4249-b8ad-936888fe5bc8", "comment": "Malware payload", "value": "0fa8386d775aa4f4346ea4c24d8faf3479ac763e59710303b46b379ea547cbabb9271d61657d9bd2a2498a300e10888e", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510831, "uuid": "42522a3c-8a0d-478a-84d2-34cd72691193", "value": "T195D46D51BECA6EA1EFBF47B78361DA2D1126736D03A0A6CF6643019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510831, "uuid": "9061e226-9e3d-4aa6-9a5c-3a9ab55d4d5e", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510831, "uuid": "0a83d843-84ca-471b-b5a7-a83e51d864dd", "value": "12288:g0Ws7IMsR4yVld8bzbBSreSBY4ZyrE7K3yl8PeVooA/AB2LEJZWiAQPUqjK:g0bskX1CBY4ZyrE7K3yl8PeVooA/AB2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645510831, "uuid": "5303fc02-9117-4288-a1d4-cc39793dee59", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645510831, "uuid": "b63ef9a6-5582-4ab9-9728-d5df9da0a6e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510831, "uuid": "fcb9b22c-7577-4107-9f00-4d2181b04926", "value": "offer 210222.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19636e4a-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517515, "uuid": "2e0e0e89-15c7-4596-9e80-c10fdbca9e98", "comment": "Malware payload", "value": "39f5fa205998989a54b9da8c2b5164c7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517515, "uuid": "9eb62066-fe68-481e-b46c-9c70265b109a", "comment": "Malware payload", "value": "c625b2864bdf24c32c191d95b8db66a590841c7bffdd8e434ecc459ef23429dc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517515, "uuid": "9c6085c5-7ef6-4019-93b2-01d27d50d6ef", "comment": "Malware payload", "value": "8c5a7ad54b1fa919385a8d42d86420393a97aed8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517515, "uuid": "db4266cd-8d51-4a56-a05e-e147c43de425", "comment": "Malware payload", "value": "c3b5e1515114a1734aaf0abdfc811aad6f5e365c0213b0e04a782ad412c91f69eee2d180f62d0e0bbfdced2311c3ca44", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517515, "uuid": "0e2f882c-a9a7-437b-a486-ab94b24840b3", "value": "T1BD84228178AAC337F623583C8DC4DD10C336DDD3A75AB895317E786DA9B43058ACB5A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517515, "uuid": "a92f2777-504b-41dc-add4-11c3bbb170c1", "value": "12288:jHXMbe7s6481Nphc7SXennZ9PtULUD9EHj5VCV8:jHXieH481/hvX6nPP6LUD9EDW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517515, "uuid": "79d80839-403f-45de-a455-bf1cadbc4f8b", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517515, "uuid": "656f29ff-c3a4-4f04-8432-304eb799a2e3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517515, "uuid": "79f34102-03d7-4038-b365-dcde5f5568f4", "value": "Consolidated Submission Listing 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf0ddc1-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645515830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515830, "uuid": "23001ddc-eb30-4981-b606-afe9cdc81817", "comment": "Malware payload", "value": "c1128d98ee3f64f2237a33ac2a245fc5", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515830, "uuid": "43aefeeb-6ad4-46f6-8677-04755546ec76", "comment": "Malware payload", "value": "c668c35bd79dbb05ed82102452245b5f9384c36478b2c058f823a36567e47c9a", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515830, "uuid": "19b31c22-6354-418e-a780-63a00691504d", "comment": "Malware payload", "value": "b579169625f0caeec9985bb47e7c81dd38f10f76", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515830, "uuid": "639a6cfa-c2c4-4cbd-93df-6cf03ff4324c", "comment": "Malware payload", "value": "ea700c4683a331a39f0d51f08e40eee7f51f00b6eb61e1deb8407e014057ea5de95e810db952e052dafdc4cbf22d6a42", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515830, "uuid": "61228401-9882-424e-9360-d51f8f0b03b9", "value": "T18923D028C9011706C173693DD4B9D4E109668C17B215488FD5E9BE4F1BA8F9A2B8FFCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515830, "uuid": "e1637631-7602-47fa-80f5-e5e2ac12a8f4", "value": "768:N+8RD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTd:N+GJqHt7NJECQFfqAqu4N7yO41/K8NyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645515830, "uuid": "3e742354-9178-43d6-a12c-f2469ea86af0", "value": 48008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645515830, "uuid": "b56b4cbb-1967-4202-b732-cb005f43bceb", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515830, "uuid": "2112d271-3326-41cd-9e85-3ef2c0a3e725", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340b7b7a-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555785, "uuid": "8a7b2f1a-ea8f-4ad5-a3e6-664e1d38c064", "comment": "Malware payload", "value": "1d31947e8e67d544a26fe257a9fd570a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555785, "uuid": "a1c52366-ca41-4a01-9a41-2720d793353b", "comment": "Malware payload", "value": "c6df3d693df3c07696748af4f2c2b3e075774e497c79db156fb8e57e215c04a0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555785, "uuid": "7fb863af-9816-459c-8432-50bebad44a53", "comment": "Malware payload", "value": "fee0c7dd03115d95bd8d6ee78192a183f1ed48d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555785, "uuid": "e589696c-60c2-42a3-aa44-302fd108df8e", "comment": "Malware payload", "value": "e9bdb0480332ca3c31bc4ad98ecaeeed5e40a4b726ad65279d930996c4a5cef025646aca92730a7dae232c2d0205d719", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555785, "uuid": "9349d622-7e74-45db-a973-bb26fc007014", "value": "T11AD2D016CA40B440F25B9976E80096F2BE849555C2ADD32F7462F37C0BA18CB97AF3C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555785, "uuid": "bc41d3b6-5008-4e58-8f7e-6b7b90c47a5a", "value": "384:BN7CoZrKZ3sNL9c91ym7v/OyMZwA4Jx0f7Is+KhZZCVFstSBN50hRtp0qgApg8Bq:p+8NL9644WH2LZrAZCXIvCqggnBvR12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555785, "uuid": "f4d20ff7-ddc1-45c1-96bf-fdab6c049571", "value": 30580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555785, "uuid": "658514e4-edd7-4f94-9cad-420bf7e97149", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555785, "uuid": "575a6858-8794-4753-8aa5-da85f86d1f02", "value": "tmpi0pw544u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c762356b-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645518237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518237, "uuid": "2f9e1530-a8ee-4c1b-9d7e-c50afd82b405", "comment": "Malware payload (Quakbot)", "value": "862b9a6307847170f04a809256481984", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518237, "uuid": "3598cc30-8cb1-457d-bb43-508db768e456", "comment": "Malware payload (Quakbot)", "value": "c7a2ea098ffb5949f98ffee5c169fb9331aba20eb488e38c8ce3dbaa8b60767a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518237, "uuid": "57a2d5d5-e707-4c3a-845b-3571f2f359ea", "comment": "Malware payload (Quakbot)", "value": "af9a532cc593e75422ddfc783aa6df215fbbd849", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518237, "uuid": "4da711b5-87dc-4eb3-9602-ba542669e1a7", "comment": "Malware payload (Quakbot)", "value": "2a18f109e650aa0bc6a47389776dbebe7e94b98526165708fc95098cb85c42d5c0ce4e255fdc9c8b77c47067cdb52be5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518237, "uuid": "9e39ba20-f149-4aba-b1f5-ef09b9b6e0d2", "value": "T16444BF829895304FEF1FE833CA57CBFAF089A574B472E0876E9F50E35E85342568570A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518237, "uuid": "74521c70-d51f-4201-ac4f-e5b44e9a9965", "value": "6144:uO4xg53oqHWu0000000000000000000qSfPhTD7ANHbA2UUUXWp9BWZa:n8gvZw5UXTBaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518237, "uuid": "85680e17-b29a-4b3e-9490-8f83d897ae6d", "value": 270771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518237, "uuid": "dd15a32b-f1c9-41cd-8f16-fa8f8b047184", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518237, "uuid": "e48ae9a3-f9cd-40c9-b961-be09f8913939", "value": "862b9a6307847170f04a809256481984.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485bc068-93a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645509004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509004, "uuid": "6b755f6a-166b-4e44-a7c3-a9f65821b170", "comment": "Malware payload (Mirai)", "value": "1bde6d89773460dc5e4ad7bfa0cb8cec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509004, "uuid": "975b1d15-2c43-4c35-8497-07b75514dab9", "comment": "Malware payload (Mirai)", "value": "c7beee6c35f368d18edfbe7bf6e7d8b89d906074b275ab333c87ca29837fb57b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509004, "uuid": "5eb8bee9-b0ff-4aaf-af58-31d228ff63b4", "comment": "Malware payload (Mirai)", "value": "4ef5e93e8b58d55b25cbe9d33c06ab0797d04c2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645509004, "uuid": "10a60df6-7fef-4618-b242-d7f012a5e655", "comment": "Malware payload (Mirai)", "value": "85c66c09e868779e64dade85386a719722b754f1da394eaf18cabf0388222653a923148c1d7bb07a359b1de0776b840c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509004, "uuid": "309b43d0-744c-4db3-890e-a25b3fca907f", "value": "T16413F17183106CF17422E973265EC8C23F264A7EA4F43A2A38A1120B174623E97FE9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509004, "uuid": "7f8e7bd0-c096-4629-bf5f-47c64ab6c49e", "value": "768:+6dVRkxuoMn0Rx23oEsEo9l8i99f4u+nSspXhj1VICgl9awfnur9s3Uoz9I:LkxudnNsEoF99f4uOpxTICw9adAz9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645509004, "uuid": "fd6d0e2a-a092-471d-a314-5793de5dd022", "value": 44900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645509004, "uuid": "d77fa052-b96a-47a7-bc34-dc3ff80bae02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645509004, "uuid": "99fb94b5-cae5-482c-ac27-38049152bd59", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd60a932-9426-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645565572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565572, "uuid": "8577baf9-7a1e-4d7e-bc81-f43a6fb07a24", "comment": "Malware payload", "value": "e064f3b5a1fa921759f34525fa39cf6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565572, "uuid": "1b0d2c9c-e13a-4681-8700-7fdf8864e71b", "comment": "Malware payload", "value": "c8420237b108ab3a1ea1f2aaa1476a8213051f78177c1ce97c9a38250798cb27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565572, "uuid": "3312f417-9b41-4075-8aa3-d0330b08633c", "comment": "Malware payload", "value": "61a7be23b8d4f30a9e9ab6c064a926c64a9b7f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565572, "uuid": "305e9d17-41a3-4acf-8e70-aa4b01542978", "comment": "Malware payload", "value": "9465e562d784b662274212f7f2775edcd2d6a45e3225fa7027b5b0d4514a68fb87f4b457eaca93ad44315bee15fef717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565572, "uuid": "8643b06b-fcce-4aa1-8449-13ad034cdc40", "value": "T1A38686AD7243C2ECDA3E8BB09A05237E552D3A7D9B9E1E7F587617990C8242E3435C34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565572, "uuid": "82ad4bfd-679e-4691-ba23-21a151dde0e8", "value": "040bf8c6dc77209e89ac091aee70ec76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565572, "uuid": "af6d2b68-3b7a-4402-ba12-0f7db892d4ce", "value": "196608:O+HpTSjTxPityVJ56ZZFA04qvCDDggFPQuJHP5oCXE1aU1yx:b4BpGanJvDEwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565572, "uuid": "3d18241e-f1ac-4dae-b2d8-cfbf445412e6", "value": 8395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565572, "uuid": "9c952442-b8da-47d2-bfa2-4322297d5a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565572, "uuid": "71c99ce5-4eee-4d5a-ba7c-6567d7c673c1", "value": "hellscape.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914045a4-93b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645515139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515139, "uuid": "bf5ec95f-b90e-40d7-87ec-c05310d116ff", "comment": "Malware payload", "value": "d0671afe32597d5824f385537c8d835c", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515139, "uuid": "2990fe0b-107a-45d9-bd20-6f861f7a2371", "comment": "Malware payload", "value": "c8996b6d49ad3320cfb024b72250d5d6354227ef6418a1ae50c05183edad3a28", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515139, "uuid": "7f435aa1-feb7-4cbc-838e-7d7bd428c9fc", "comment": "Malware payload", "value": "c72339221ebac3556fdaa4a548650a7b690221c9", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645515139, "uuid": "8aac88cf-4882-4f6a-b7e6-6404dc06fb46", "comment": "Malware payload", "value": "73ca79528834c5a68d6d43b90500766d21128227214d65a938c1b73088cb2de7280274e0ee42104b5a55ad6f0f9cda72", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515139, "uuid": "8ecca934-c5ad-4695-bef6-52bc84aea87b", "value": "T17E23D02CC542130AC6B3653DD0B9D4E01D669C57A21549CFD1EEB94F0698B8B274FBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515139, "uuid": "cf485778-300c-40ba-8534-83ccb2a8e3b7", "value": "768:VRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTCl4:bJqHt7NJECQFfqAziQQmo1/K8NytsRmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645515139, "uuid": "3bef8e5d-208d-4d13-a095-707657985a89", "value": 47992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645515139, "uuid": "00371c0d-9230-4e87-8128-35a272b60edf", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645515139, "uuid": "15ea59e0-6650-4358-bd59-ce5f7991fd9e", "value": "PO.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841d0f88-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "be9a3b8b-bc3b-4014-aa80-f791da3a9904", "comment": "Malware payload (Heodo)", "value": "bb9a2783737e4cdb58db314df99bc21e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "d7773308-469d-4910-a8e3-3b1d0ea756cc", "comment": "Malware payload (Heodo)", "value": "c93086b2076808ac8812b6bfb2a5cca9c9f3ba56221e6080c38bebcba49de08c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "6b25295e-0efa-442f-8f9b-e73afcb57680", "comment": "Malware payload (Heodo)", "value": "0fb0cf0a901593dd7b716312e1b27c054dcdf760", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "c6cd3949-3367-4294-bfdb-8c5d217ad66e", "comment": "Malware payload (Heodo)", "value": "0b2cbc35f43147d22d10fd373f23f4d5bc522d97ae8844bab44dd78ae16bc1508223f7631b43fa8d2ca5faf5ab57df0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "94b4f9b4-f39d-42b3-a3f8-e12a12ecb13e", "value": "T1AFB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "f8d6fdc4-83ec-407c-9aee-23a4785c36d3", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "32090084-2548-4498-bad7-c7d8f0b2fc88", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wUIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWjzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564939, "uuid": "bf9fec4a-b047-44e0-8e50-298e3bc424d7", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564939, "uuid": "61714314-2022-4d64-9f13-61045a53d5b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "82a53aaa-3002-4dcf-a85d-b03e1216099c", "value": "emotet_exe_e5_c93086b2076808ac8812b6bfb2a5cca9c9f3ba56221e6080c38bebcba49de08c_2022-02-22__212213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770ac02a-93d0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645528410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528410, "uuid": "f54ca09f-3f42-439c-9813-cec413c78c22", "comment": "Malware payload", "value": "71bc4ecd64109b06942523f0d188423c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528410, "uuid": "67614a56-5c6f-4b0d-8553-96f7a9bb5f8c", "comment": "Malware payload", "value": "c9a163ff2c856ffe2313786457ecc1792a9f19758e88712218940b803ab24055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528410, "uuid": "1d00b22f-65af-4d45-9f19-73de64a85c99", "comment": "Malware payload", "value": "370939d685b34d68ad83bb697d100a8c28e00e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528410, "uuid": "e0673e5e-9019-48b0-9e2f-95fe36b783d3", "comment": "Malware payload", "value": "eaec82a21707163834dc2591d517a42c1a38da057ac13a86f41309ab6a4bef01b07d621b86801c81408eea105be752c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528410, "uuid": "c286a70c-b4a0-486a-b793-da0e47ef3eb8", "value": "T16552D783B7574922EDDD057424B9D650923AFD604B005AFFB1E43E6D1A32BC0AC32B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528410, "uuid": "e4bd0ed1-b32c-4709-8a9d-52b44f56edfc", "value": "6e4035f1dbacf928aea2c42f0db3dc0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528410, "uuid": "516b5431-30ef-4cef-bcaa-3baae6c21cff", "value": "192:waW+hYZgW7BXxXqTb0e/DiIoAoxADVWwr9GXIRJT3k:wIkBXxX+0eGZTaWwhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528410, "uuid": "f44e0d1d-3d38-4d84-9614-c3851877d097", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528410, "uuid": "ff6788d3-748e-4bd5-9ead-f95f71c46c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528410, "uuid": "ae6ec90a-63ad-445a-b53b-8df10cd43c0f", "value": "cond.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be32e751-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645513926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513926, "uuid": "90657caf-ed7b-45c1-817b-ecaef2d7ef88", "comment": "Malware payload (SnakeKeylogger)", "value": "e7a479a2179b986207311c8e640f7e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513926, "uuid": "e9f3e7cf-078c-4ee9-8d55-60c840fb361e", "comment": "Malware payload (SnakeKeylogger)", "value": "c9a713881a9bb994b801b8cb3b307112839bb18285f4828f73e7f0de4f2c6c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513926, "uuid": "795ced87-0097-45e9-86d5-01f01da2fe9f", "comment": "Malware payload (SnakeKeylogger)", "value": "ece383e8e60bd8602fdd9582d6da3bf2a0c67867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513926, "uuid": "442a6561-ad96-49e5-9b1e-7318a6fd21bf", "comment": "Malware payload (SnakeKeylogger)", "value": "baa05242e412c413dba40a6ba056ae4c4392ddf29417c1a9908b9aa50597cb056cba1ac555ad340963070fe8cfebfe41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513926, "uuid": "d85556b4-293e-4ce5-97de-28c40d050ef7", "value": "T19054028A61DA31FCDAAA4FB86D21F1202735BD62149BDE1D2F8075C8067374112B6F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513926, "uuid": "345452c2-2440-4c39-b85d-07295ee5e254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513926, "uuid": "f12f11e7-cab9-4e1b-b8d4-930dd062e12b", "value": "6144:oxtvJ/xa9xv7qFdhEyPK4/0tmFlfyGSMeinvXnImWy:WFxQIfh5oAVbnIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513926, "uuid": "f8f501dd-7dbd-426d-9545-af2636efa974", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513926, "uuid": "51dfeef7-4689-4607-bf60-4764e8d0cab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513926, "uuid": "143016a6-3898-4f7c-a2d3-c270b21d83aa", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9663a820-93e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645537482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537482, "uuid": "6ec3e08c-c5ed-41d5-9d67-abf07042ce06", "comment": "Malware payload (Heodo)", "value": "e5701b0588ac38a0aebd33da06049793", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537482, "uuid": "b59e85c9-7cc7-4db7-86e7-6b8474afdd08", "comment": "Malware payload (Heodo)", "value": "ca010dff4b80182c78eb12a85ba8163e7faf5853d63b43d7a5af1e69c118a483", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537482, "uuid": "72e2cb44-d783-4e67-8057-2f6cdaf740e5", "comment": "Malware payload (Heodo)", "value": "11db8a095b3d3a539d2a82ca349558ea3890e415", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645537482, "uuid": "82f8d8b6-bdf9-41b8-a1ec-3751ecd3746e", "comment": "Malware payload (Heodo)", "value": "cd8f460d4ffa59d6814dadaf803a89520c508069f176583dda1863a4c6f504c0a132b6c7b4c3417002f3112f12a1718e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537482, "uuid": "2048bac6-e3f8-4eb5-86fe-433bbbed344d", "value": "T11FB4BF10B2D6C476E1B62A38957253B15A7DBE13FE38C25FA310BD8DBD316408931B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537482, "uuid": "8fcfd798-6b1d-4e62-8f2a-e4d7e11a70d4", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537482, "uuid": "c02ef675-9da1-4409-92ac-53833b239de8", "value": "6144:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB9iHC4CqhAMQvYqq/9CwU4LkUNJIEP49f:3Qw+CM2n9+6qsRlSLhIe9hwU7IEP49f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645537482, "uuid": "662c00ad-3374-4266-bea7-1abf69cf8195", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645537482, "uuid": "17b50405-65ed-4ed4-ab3f-d98bb4068398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645537482, "uuid": "b85e46c6-eff6-4c58-a3ae-45089f534f16", "value": "emotet_exe_e4_de8e8f7074632a90f720d981e43f39f463de0f9155610449c2cf084abc024d89_2022-02-22__134437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823d79da-941f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645562359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562359, "uuid": "5038a809-f5f9-49f7-b2b9-484c57d7c9e6", "comment": "Malware payload (Heodo)", "value": "c55ca774fd023c4c4161acd1d8c6ac81", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562359, "uuid": "f1dcaf30-f622-4939-8fa0-78849ed23bd6", "comment": "Malware payload (Heodo)", "value": "caf7f4e9c941197356b2cd8a50cdb91a2cba8ef99f37fe3eb56bd7d0bb6cd5ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562359, "uuid": "637bc251-86a4-4e46-8c65-d31d43a30e93", "comment": "Malware payload (Heodo)", "value": "fa88ca006a843ec917b9c5d6a6b92a51f868d1c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562359, "uuid": "75787941-4401-4112-bd72-73f95385d860", "comment": "Malware payload (Heodo)", "value": "df7f4b28d8eceac6849cf09b8ff89ed904a42d11e386193d4d798850792d6cd21925990811a6e477a994ac9a2bdfef91", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562359, "uuid": "2c4f4101-6dbc-48cc-96ab-9532e59cb5c6", "value": "T1C0A4AD21B7D0D032C2AE31746A16E3B56AADB93099F592477FC40B7D9F351D28A2834F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562359, "uuid": "e9fb5324-b112-43fb-8f8a-88199f1f08c3", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562359, "uuid": "7571c19c-3fcb-4da4-9174-4478afd478c5", "value": "6144:PFdhYCryBe9NY/55YWAVtXWUVPlLX8IjMpz5yRszIpqAiA8KQd5dhMYi7nwZJjIF:dPY8Y/7nctXWUDIpz5Gs0H2fTSRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562359, "uuid": "54f540a8-7c7d-4e23-a22b-3671bcd305db", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562359, "uuid": "ddd479b4-4db2-45f9-8afd-2c16a7175ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562359, "uuid": "f5fc015e-4750-4d86-be4f-7954a479e4df", "value": "emotet_exe_e5_caf7f4e9c941197356b2cd8a50cdb91a2cba8ef99f37fe3eb56bd7d0bb6cd5ef_2022-02-22__203914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8907f799-93ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645513407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513407, "uuid": "8bf9147b-89d1-4fe4-ba2f-30463f97c6e8", "comment": "Malware payload (Loki)", "value": "743522792c261edd8f245a043b386ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513407, "uuid": "92108e75-bf03-46e5-a132-0274158c3b62", "comment": "Malware payload (Loki)", "value": "cbeaa0d6553cb7e1cdc84b7e6cd0d9d1e8d12cee120eb03ed228e8e967c9a186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513407, "uuid": "c26cad7e-e928-4023-a9c6-e7e92c0edf47", "comment": "Malware payload (Loki)", "value": "192dd71ce0113009ed307bc8ecdb3ad5914f282a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513407, "uuid": "ac883776-aa12-4d90-b271-f891254049df", "comment": "Malware payload (Loki)", "value": "265abaf1abf715617b254a13bac0a46191f6c13bb8c532a67a1549bf0fab5fb9a5eb45c617b1f379e9c9ee25eb4dafc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513407, "uuid": "67a1dabd-5949-47f5-849c-8d2c646c13dd", "value": "T18CF4CF042AA74F3DF1BA4BB259D1EC64F7A9F7231C19F37D7C502296CA52B408D422B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513407, "uuid": "9e715b09-31b7-4035-8671-b279865ba169", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513407, "uuid": "8a84b546-ba58-4717-82f4-0275d540ac67", "value": "12288:tgB6PaaNqh7jXmOZXlfnCb/RxvPhGmtpY9kKt6ych0oFhxrf0Mim0e4G:BBNf6CfBGoWWH0oFrk7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513407, "uuid": "6d2a9d5d-eb34-421c-a761-04ed30e3dd1e", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513407, "uuid": "ee7b85d6-74ba-440d-9f7f-19db0a4913ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513407, "uuid": "abf745fa-5dc9-49a7-9f66-9e3627c85a64", "value": "SV80113_007.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dd9080-9408-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552376, "uuid": "8a9c7078-2c47-409b-b0bb-0077c118bc07", "comment": "Malware payload (Heodo)", "value": "30c06a4f4d1727a7926ed31ff2dc1d1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552376, "uuid": "23ed89a9-4e62-4516-92e6-09fb964a7dbf", "comment": "Malware payload (Heodo)", "value": "cc98092f17dc879aad73817dd8831e40453b0bf984f7f0e520723b8e6ebc6d79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552376, "uuid": "190a6097-5dd0-412f-8a1d-5615982d98ab", "comment": "Malware payload (Heodo)", "value": "98f7718907fe6c1c086ce00e097b84bdd68983cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552376, "uuid": "d67cca51-32e6-48ab-ac37-a699b5aa0388", "comment": "Malware payload (Heodo)", "value": "f2b56b0fb24147821a1c777717b27d80033eb046d04962b26b03f7e9cb097851f47c8b41d77f2487457810cf6a7b2723", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552376, "uuid": "b7a3b5b7-e13f-47bc-ae02-6ebb2c7bbaac", "value": "T1F0A4AE21B6D0D432C26E30747A16E2B15AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552376, "uuid": "fa359e68-d3f2-40aa-b5b2-6ffc34c5dfb7", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552376, "uuid": "f9e281f8-7dca-4651-98de-12ab86376537", "value": "12288:vicw4w2Vb0zq6k5Z2mTgjqkGXNrGHORQuBT:viSwub0W6LmTIwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552376, "uuid": "71d5c538-caec-49d3-9e95-adf9e7cafee5", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552376, "uuid": "5d883b26-2135-41dd-aac2-3edeaa1ecbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552376, "uuid": "bd62b84b-2c79-4f2b-a7a6-0b4d692201ec", "value": "30c06a4f4d1727a7926ed31ff2dc1d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c62af10-93b9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645518406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518406, "uuid": "4fa016b8-b1f9-4d66-9bd2-4f4dd3fb7fc9", "comment": "Malware payload (AgentTesla)", "value": "1fbe4b287fa7ba9f14d6864a54308221", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518406, "uuid": "6409653a-6ad3-4ee4-972c-43e304cf0c6b", "comment": "Malware payload (AgentTesla)", "value": "cd1f59f90ff20758cf3b925e4eb7c5a3f4b8b49d2375e2f656f65cde8e2d6aae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518406, "uuid": "8286e679-c454-4035-a9af-96db0a734522", "comment": "Malware payload (AgentTesla)", "value": "05b63b0ed6a91ff0ea4f66b8c375c3913913af77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518406, "uuid": "02d2e5c9-e1f7-45a8-a2e8-9d1eae01146c", "comment": "Malware payload (AgentTesla)", "value": "2fd0f50fa4d5ef1827f3a4e1f032eb0a4db2db92d147956ea7dbb2f7e0ec25ca7f7df2620927d456066002c460752ef1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518406, "uuid": "f84938ee-dfc8-4fd4-9ff4-04d25e1cdf1d", "value": "T16215CE043AA71F3DF1BA4BB659D0EC64F7A9F3231C09F37E78512196CA52B508D422B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518406, "uuid": "64827405-aabb-47b0-b1ea-0a73d2ed810f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518406, "uuid": "bd4ea514-8536-4e2d-a2c8-45827207a422", "value": "24576:MVQNrJ8R7dD6rXE6506/IAFzYKmMRkjil:5J8Rnb6/IA1nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518406, "uuid": "18985d80-4a90-46d7-bb21-a045e9602264", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518406, "uuid": "72f04d7c-b2f4-45d4-93a0-f3c052dbd50a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518406, "uuid": "1812a544-2150-4384-be9f-4b1858d49b6e", "value": "1fbe4b287fa7ba9f14d6864a54308221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bd830d-939a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645505233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505233, "uuid": "d508e12f-f728-43b4-81f5-94a0265e4191", "comment": "Malware payload (Heodo)", "value": "591a325119a4479ab8aca20eb41651fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505233, "uuid": "6b196f60-004c-447b-bb4d-7ce9937f5a91", "comment": "Malware payload (Heodo)", "value": "cd28f9d1df11f0b98b74970e6da92e55c916c0c28ed756462b42853645eb9c75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505233, "uuid": "d070b253-904b-4408-aea7-ef05b1f946a4", "comment": "Malware payload (Heodo)", "value": "6865f8a1ddb9c9010bba01cf2291e67375326cd5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505233, "uuid": "88162cd5-1c64-4ca1-9b83-3a02fdf61262", "comment": "Malware payload (Heodo)", "value": "ab7c5fa998dfd1e0c1265e147cc460f2b33ff59f65edb6e4cdb79175bc19662433000be6dbcd08aca6789201ef6b1ef1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505233, "uuid": "bdfc8d28-2d36-4de4-91a6-5c6cdb9c4bdf", "value": "T1E835CF11F6C5C076C6AE11382025E3B85AFE7C108FA1998B6BC42DAF7F351D2963935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505233, "uuid": "53b67be6-f73a-4f85-9ae0-c56d2003e5a5", "value": "1e6c964d8ff7538cc0a7091b2fbe639b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505233, "uuid": "05de8681-a89b-4b13-b3d9-f9820b20db21", "value": "24576:89lr1VkU0h/KLhoO+li+w1ABdQvTyFIIm2m40:89lrrQ/GhodlzzSGFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505233, "uuid": "b35b5dd0-f6d3-47c1-af41-b6397bcd88cb", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505233, "uuid": "377ff73c-6744-4a22-a4f8-089a3d0af5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505233, "uuid": "9d01d2fc-3da0-463d-a50c-939a95c359bb", "value": "emotet_exe_e5_0f0a4e98784f67aeee357f824314ff1d4d13a7e37c728d015d4fad2029ac0a43_2022-02-22__044708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5e4f49-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555911, "uuid": "b704f036-f861-4875-a2f1-5377846b466a", "comment": "Malware payload", "value": "cf99fabd8a930ede37f007139d4370f2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555911, "uuid": "6cf5300c-d94d-4d98-9095-a535c725264a", "comment": "Malware payload", "value": "cd362a886c0b04fd0217d951eeacc262da9b4be1d535fa28ff0e198e20f29d04", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555911, "uuid": "6f9914eb-4eb8-46da-99aa-093dbf8fefba", "comment": "Malware payload", "value": "2cb81e4846857fabb5dab0f60d34ed8d70789856", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555911, "uuid": "462227df-bb99-4d22-b180-a0782b26e5b8", "comment": "Malware payload", "value": "0f0d0373511f7524386cac1ffb8218596cf4732e7c721b30f5be2b72de35f573fdf10d449a1f7e93717b2ababa505a59", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555911, "uuid": "eb827430-52d3-4c13-9879-3bda024e7369", "value": "T120930769B681C95BCA5807344CD7CBF67227BC424E7A87473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555911, "uuid": "0bfbdc61-8922-4484-8c0c-4cb9af6c0904", "value": "1536:ryehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQx8kWvgrPE4nWHPNc2Ax:ryehv7q2Pjx45uoDGTj+5xtekEvi8/dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555911, "uuid": "3553f6c6-d436-49a5-89ca-6e1abe2ce46c", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555911, "uuid": "59aeba7a-9f46-4d20-9c15-769e83e70ad3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555911, "uuid": "7b2256bc-72d3-4466-b6f2-8d368c877f77", "value": "tmpp6_el5ln", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1dec70-93ff-11ec-9275-42010a9c0029", "comment": "Malware payload (DarkComet)", "timestamp": 1645548474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548474, "uuid": "3e26beea-d4cf-4106-b159-6f9c58bfd3a6", "comment": "Malware payload (DarkComet)", "value": "01b72ba5282097c70c9ae5db844e0ed3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548474, "uuid": "38ad28fd-b4e1-49c8-8c24-ad2e480e2008", "comment": "Malware payload (DarkComet)", "value": "cd4483ee1a2303cb7e2789f354944f063ae2d5b9f8fb9f3d6d136b53c2388b6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548474, "uuid": "902fdf27-e589-4342-82b8-4d91feadea94", "comment": "Malware payload (DarkComet)", "value": "b8748cdb8ef7109a2052906d9f354dda9ff1203c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645548474, "uuid": "5673180b-6801-436d-9587-5dfa2360ea44", "comment": "Malware payload (DarkComet)", "value": "5a84a69f5eee654d9a80e31d7da6fd54d2cbaa1dcea12e8d48a470494e3de0dcedf1d39c382229238aaa75d0c2e05789", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548474, "uuid": "46a78da7-8d16-4c8b-bbf9-76c8966c0fec", "value": "T1FE75F10526A34F3CF5B91BB699C6DCA0B3A8EE275D08F33D79813586CBB17408852677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548474, "uuid": "c6ada47d-c85b-43f6-a584-b01970990711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548474, "uuid": "c262194e-158c-4de0-bab1-b8283448a157", "value": "24576:hKNiKP2sgA6xW1w+xmMi5GkcyG9B6B931q4jeZxuGwg7zy6NjoBkC5Pyw8R1H0bU:1rodqGkKB+Pj8xzy6SBkCMnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645548474, "uuid": "ba1d0b67-d30b-4981-b058-445a41494a2d", "value": 1683968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645548474, "uuid": "b3ebb728-848f-41b1-ba5f-13d23987be73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645548474, "uuid": "413095b9-cbef-477b-a148-a4a53490a8de", "value": "01b72ba5282097c70c9ae5db844e0ed3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3daef7-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503934, "uuid": "0f5974bb-0cb6-4acd-b7b9-8b7386c8683e", "comment": "Malware payload (Mirai)", "value": "a15cf5bce4f8ceed65aa039094c15b89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503934, "uuid": "6cc9dff5-4091-489b-9028-bad0dc2c815c", "comment": "Malware payload (Mirai)", "value": "cd67489a54fb42905f9fd496827cc246b31a3540d40959eb77c4cedab4ef602f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503934, "uuid": "53f14307-ab70-4786-b403-f11cd8ae6c23", "comment": "Malware payload (Mirai)", "value": "1d0e416de8e2beac8d3e1db7a4aeb47a27778813", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503934, "uuid": "ff7b0f2d-8792-44bb-9fca-230f0dce6291", "comment": "Malware payload (Mirai)", "value": "38fb1470ed6be3f2bb7d3dcdab2304601c5b76f3c6445d9da3ec0ed86d3993c007f05fa404ef3b4575c3c9d842aa22a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503934, "uuid": "68de1276-1a6b-46c4-bc86-1b6d3188281c", "value": "T1AC23018DE96C3492C33CDDFCD1AC087AB0102747857BA7479F2ADCD1A4418DDA9851BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503934, "uuid": "c70f309c-0d68-4cf8-be30-4e15af921937", "value": "768:zTADRQyPBWOBtPZvXqZSHmkQwMim793xaBcXZaZrO28GUu7EEeP1f9TIG9I/r61y:zTADR9P7tPZyZSvQ59eS2S28C7EF11Ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503934, "uuid": "100c749a-9bf9-4ad0-9bae-2ecd23628f56", "value": 46488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503934, "uuid": "84f96fcb-ec2b-45b9-a477-40ea5711bd31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503934, "uuid": "49ef6ace-aad1-4a05-9455-ebb5c7056616", "value": "a15cf5bce4f8ceed65aa039094c15b89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9e9b3f-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550508, "uuid": "3eb39502-7ec5-40b0-ae0e-1860af3c3099", "comment": "Malware payload (Heodo)", "value": "c2b844990b12c4587a5467f34767e8f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550508, "uuid": "8a965058-95fe-4eaa-affb-d1d287c6e8c1", "comment": "Malware payload (Heodo)", "value": "cdd0101b647eef23ff2080af74f32ec61fc3d851e0a286da3972ee1222f24248", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550508, "uuid": "213b99ef-aa94-40eb-b7a1-6fe2fe4e7962", "comment": "Malware payload (Heodo)", "value": "cf4e3bcc774b9ec2b8413cb5f812916d0402810f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550508, "uuid": "0f0fc3c3-229d-42b5-8d0e-59ed56838be7", "comment": "Malware payload (Heodo)", "value": "a90a32e922daec05cff0c107a49fbefec988ec7234cb6c18b0ce90a92ae2acf58085ec63dba88896536fa8de3b927933", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550508, "uuid": "b9a430f0-16fe-4512-9720-275fd061ef9a", "value": "T105A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550508, "uuid": "6c263eaf-f367-4f83-af08-7a6e0f85f327", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550508, "uuid": "c1ac6ae9-42ad-489a-990c-f338f83645cb", "value": "12288:vicw4w2Vb0zq6k5Z2mTCjqkGXNrGHORQuBT:viSwub0W6LmT2wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550508, "uuid": "c33d246f-de84-4d49-851b-19d0fef8e7a6", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550508, "uuid": "6e3519f4-f701-4f33-a68a-d9d2628fcf6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550508, "uuid": "37330ddf-c8a8-408f-a30c-53c2ec06f287", "value": "HOJaKXdntfoDkHoMPeZQMuZE3oWwudNn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050941ee-93d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528218, "uuid": "c4ec0de3-00db-4143-b763-c4dda48ed50c", "comment": "Malware payload (Mirai)", "value": "4899d045117092442b6854ed4a7cb537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528218, "uuid": "a6896062-28b7-4575-acad-ebfdc44e629d", "comment": "Malware payload (Mirai)", "value": "ce406ce8e95bb59f95c3f210e601f23909b07876b573cb9c6306e06e51cf3576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528218, "uuid": "bfa44af4-2a59-4c3e-8a6c-91c6190783df", "comment": "Malware payload (Mirai)", "value": "7eb084b38be8a73b423c77ee13792db0a13ca9d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528218, "uuid": "e637ab0d-7f97-4016-9411-4e5052e84784", "comment": "Malware payload (Mirai)", "value": "802e800c253d73e4aabdf61890d87baa9a0db23fe33e2926c1c2fca3e15a0b11a75a5ab055bd6d6a42518dd1a0a9e286", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528218, "uuid": "e621ea82-0ad8-4c4b-9bf9-18cfe0f9717a", "value": "T150235CC5A447D9FCEC190A752177FF319AF6E93F1098D983C398AD72E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528218, "uuid": "c02bd9a5-8952-48c2-a827-305b2917abd7", "value": "768:Ii+liNWE5NttVEi4Ws5BkbVTco8UTMWfd/0A6SDZkRyo:IiK25NttVEi4WszsVTcXWV/0A6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528218, "uuid": "bdf00b05-e18f-4d4d-9e36-df148688f90c", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528218, "uuid": "0d6bef89-7562-4c4e-a3bc-90f593bc810d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528218, "uuid": "739f1ac5-8b9e-458b-bb52-32aa05d94bc2", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483df941-9377-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645490106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490106, "uuid": "dbec2468-1c53-4fea-a5f2-a3bb7fee31b4", "comment": "Malware payload (Mirai)", "value": "21c27d821b56fc28ada089dfc162de58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490106, "uuid": "59e8862b-cd7e-4964-89eb-17eb5b06dc18", "comment": "Malware payload (Mirai)", "value": "ce448e6b559a362d434810c18cd2c2f021d3fef1f010044081b7ddc8349b4abf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490106, "uuid": "17d30d13-9539-4d41-9d95-837833a08327", "comment": "Malware payload (Mirai)", "value": "32958089ac49577571291abf50e0db96668c62ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645490106, "uuid": "dd1acc85-48cf-46b8-92d1-90bb27948704", "comment": "Malware payload (Mirai)", "value": "653454796e6bc3a521fee9455720fa89a5c2671d4666dec7f8994f456b84ba2b6dfdb026425c69df4ec4eeccbc65dd28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490106, "uuid": "4c91d947-e8fc-40cb-892c-a5816f40932c", "value": "T18AE2D09DF45479C9C8F5BC3F964E1B301A5051C8BA476F9637321C6D7BA988226086EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490106, "uuid": "3e15bf07-3aee-4d2f-ab76-848e93ad3321", "value": "768:NygIKfw8EBsLpWTvZg1kOJh+aG81AJq/i77WG:bh3EBsLp2c1JhQuHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645490106, "uuid": "1a790feb-5567-4e31-80da-bd2c6773b3d1", "value": 31632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645490106, "uuid": "5c22905a-5d33-4cb0-82b3-a8d606fd350e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645490106, "uuid": "73fb4646-e653-4b98-a77f-47f9f2fab051", "value": "21c27d821b56fc28ada089dfc162de58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9111a95c-93cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645526735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526735, "uuid": "018f3046-fb73-4837-9073-ec65ae02697e", "comment": "Malware payload (Formbook)", "value": "5918a2d054d55152596a17c5ab897e6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526735, "uuid": "50ef07a2-a404-4a70-8700-a0a6139274ba", "comment": "Malware payload (Formbook)", "value": "ce521fb54f70a43f7d7a917ed593b580f8291f0189fb5cd0ee239a4f1a8c2f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526735, "uuid": "70f85170-9052-40dd-b3b4-ddb9fd6ccbfb", "comment": "Malware payload (Formbook)", "value": "ab581f1eb805188779e1b80847efc137c394977a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526735, "uuid": "6f0b41b0-6069-4871-ad15-ddd0911b309f", "comment": "Malware payload (Formbook)", "value": "ff90775f6683be11a7eed9af4ff09e3fe0fcf824f677a02fb97f1edaa1beef1a50ee53a6dc4330508c5b39ada8aa3702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526735, "uuid": "c17d6500-147d-4905-a5ef-7bfe4ba780ef", "value": "T1D4746BF1A740C469D8A79679843BDAA7B433A20D9CA8090D3D92FF0B7D723474027D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526735, "uuid": "f784e1b5-5952-4d01-ac7a-7f9dded5a26b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526735, "uuid": "70e836cb-4e43-4a01-a933-a2e5435cd080", "value": "6144:ExDwuDA1+OLoAB6QGxLk8EcGTJewp+llTEp9qAo:FgA0OvB6QTUGNewp+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645526735, "uuid": "c191cac1-cc48-4ab6-b6d6-9a53176d87f8", "value": 341372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645526735, "uuid": "a46f7094-a47a-46ce-9d48-0ac93d02b77b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526735, "uuid": "1f9f2ebc-9bd6-4ca3-aa61-62e8ebd7d55f", "value": "Advice-BFTI_EFT8502070029_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29b6562-9418-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645559406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559406, "uuid": "1653d8b1-ca37-4aaf-8436-829f3ba5f8f7", "comment": "Malware payload (Heodo)", "value": "72a571a7a7943b52de88a1b743548438", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559406, "uuid": "da2b7e45-de90-4136-8932-83d4bc3eab12", "comment": "Malware payload (Heodo)", "value": "ceab988bfc73ea8dc6844c2d5fdc5071dbf66b350a495f1166b42bb4e401a3b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559406, "uuid": "6dd2eb4b-6089-4c0f-a85a-0854051d73eb", "comment": "Malware payload (Heodo)", "value": "ff1dd1c016a96f39dce4b0434ec42952c4958851", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559406, "uuid": "ff136df8-e272-4932-82a8-e1a4c02abc8c", "comment": "Malware payload (Heodo)", "value": "d104f25c49d5fd9bcb2d42a9d1e7c413b115d20bdc5caaef833751e03be3499b194ec935832e26c8f3532c27e09de003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559406, "uuid": "16fffa0d-3cbf-485f-811a-21389cad124d", "value": "T190A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559406, "uuid": "6380a3b9-0c11-470b-b81c-49696ee79909", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559406, "uuid": "4ee8e5b4-944f-4455-a831-e28628e5d648", "value": "12288:vicw4w2Vb0zq6k5Z2mTOjqkGXNrGHORQuBT:viSwub0W6LmTawNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559406, "uuid": "51664643-c393-46f6-bd65-a8474dda081f", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559406, "uuid": "41cb602c-9ee0-413d-8595-73aec56ab6ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559406, "uuid": "27dfd8d2-6f47-4692-9e64-80d37e2ef0d3", "value": "72a571a7a7943b52de88a1b743548438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4166bc44-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645554948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554948, "uuid": "735e1fb6-915d-46a6-a5ad-894eefcc9625", "comment": "Malware payload (Heodo)", "value": "713829ca42695ccf9e77cb9cf0f79dc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554948, "uuid": "c1703251-c1e6-460e-b248-17bc126f24ce", "comment": "Malware payload (Heodo)", "value": "ceff283de668ab5780670533b8982f6747f97767497fde1c7a4e6eea095d1034", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554948, "uuid": "e6cc4b9a-0b3e-4ae2-80cc-c328d5298f79", "comment": "Malware payload (Heodo)", "value": "4787ec6fae21855ae7aad937848a6de040b151a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554948, "uuid": "b22b3261-53ae-4597-a5f6-0050973ed774", "comment": "Malware payload (Heodo)", "value": "47936d954e295a363a9bc2e9b194dd0c9dc781e02586a23d828e79ffad857ba7468e0e5263fffa80f80ac9976a7b020e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554948, "uuid": "fbcbe335-c9e5-4c93-b14c-8e435bf6ca2e", "value": "T1A1A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554948, "uuid": "b6f778a9-8ce0-4798-ae7d-fe9f991f05c6", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554948, "uuid": "798467a9-801a-4aee-90b6-ab1359e8bbea", "value": "12288:vicw4w2Vb0zq6k5Z2mTBjqkGXNrGHORQuBT:viSwub0W6LmTnwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554948, "uuid": "1b74b49c-2144-40f6-ae93-61dd160d6b80", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554948, "uuid": "214f93b3-1e5c-46cf-bae7-ee684a91e594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554948, "uuid": "526db453-51d1-4aba-b548-fb54e4684f6b", "value": "713829ca42695ccf9e77cb9cf0f79dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19c1357-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555110, "uuid": "ca16da6f-0d86-4fff-8177-e6a8bc93bd9d", "comment": "Malware payload", "value": "a78574f3cf1beed793dd99ae900abafa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555110, "uuid": "fcc481f8-cb12-4675-8b4a-2d17c64c1e04", "comment": "Malware payload", "value": "cfc046f168969c75193ca61cc39db027ec04e8f38cc8f9b479f92f46294f64ee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555110, "uuid": "50a73eeb-4eba-4248-8f17-dce6dbc5d640", "comment": "Malware payload", "value": "7d106f1949fd7536fdf53a03b83f31a94490315a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555110, "uuid": "1738dd8a-b36f-4b7e-987b-33133c8f5d82", "comment": "Malware payload", "value": "469b998aed01c6fa8694d634d8ffe93f91a4af77795179bf03a4ff0cee434efc849159db57e977a787c6dcb4c0a08add", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555110, "uuid": "148baa4a-e72a-4cad-8654-ce214a4d4c0d", "value": "T1E5930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555110, "uuid": "fe5e1122-abb3-4658-8d90-acd63ec9ed8a", "value": "1536:iyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQx0kWvgrPE4nWHPNc2AJ:iyehv7q2Pjx45uoDGTj+5xtekEvi8/dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555110, "uuid": "f46901c2-2137-4301-afca-831b27c578a4", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555110, "uuid": "b194733a-ab26-4603-8f95-72ea6174b2a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555110, "uuid": "daa21489-eadc-45b9-96b6-7504326016fb", "value": "tmpcrzs1laa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2c4b36-93cc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645526697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526697, "uuid": "a80fe493-5a89-45b3-a159-361b72c84391", "comment": "Malware payload", "value": "81c90f537c8d96f39f0e30b75d9f74b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526697, "uuid": "f39235de-e45c-45e0-8ab8-c13289e98bb9", "comment": "Malware payload", "value": "cfe10139cf517cca8373e2ba67fc139ead5ce46d2608a9916fdde95d326c1838", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526697, "uuid": "5c29156f-7fac-4202-925b-a2752889c81c", "comment": "Malware payload", "value": "dda4d6a9695dc9bae183a102cb030b21c5d39b48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645526697, "uuid": "10b41e1c-44a0-4d6c-82e1-229c98a51321", "comment": "Malware payload", "value": "afb8bad13977a0da41eb602bb9689d0f4f0624164d8401ca30deba294f9bf5cc708423d643a3690640e7aa76c0de6c80", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526697, "uuid": "e0ea78f6-65b8-4b35-8943-23df97dbaa8e", "value": "T18F3228B9866D8E9CCF8A62F0633AFE8901DDBD15A7C1F095757C63B00B1377E421A060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526697, "uuid": "c4986a93-1e5d-4adc-9fb5-ec24969735ef", "value": "192:Hz4oAL7furANL30VPb/22GyzyjzYqdV0m3RlbHCH5gtm6eTq+Gof:HILiro3ED/RW4qdqm3R8mhebV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645526697, "uuid": "d4f47be0-d022-47c7-a9d0-2c3654129c29", "value": 11206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645526697, "uuid": "5d330234-99c1-425f-99af-0887bba784d9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645526697, "uuid": "dd505b80-6ffb-47b1-87e2-f4f88cece8a9", "value": "Modez Professional Systems- RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b048abd7-9408-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645552557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552557, "uuid": "72af5bdf-a831-46da-9306-cedda005b218", "comment": "Malware payload", "value": "3bd811da22d064036b5ff0cfedf79d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552557, "uuid": "dc3e4297-f249-4759-b03a-c9df8119d069", "comment": "Malware payload", "value": "d066ed9d71d95f1c0d212327af37be6cdd376e116fd3ca1a204a6c23d0dadf60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552557, "uuid": "7ddf5dd6-58cc-48ba-abde-131706712d61", "comment": "Malware payload", "value": "3383771d7176cd38fc3868b83577d1449bb50200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552557, "uuid": "da0bf570-bca7-4a34-aeed-34e7607fdda8", "comment": "Malware payload", "value": "46663c6bec4959f27b2ff4161132251ace2489b61b15f6c5793983831ca2ea163ce6c213e034be17036da2a04a7949ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552557, "uuid": "023719b5-de97-4c06-ac96-535a3169171d", "value": "T18C25399D365072EFC857C976CAA81C64EA60747B930FD243A06312ED9E0DA9BCF145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552557, "uuid": "e9492158-73c2-4538-ae8a-b00facb15578", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552557, "uuid": "7511b59e-5146-4167-a46f-108e465b5f03", "value": "12288:1cApMNNdpbz8ljYqUVxJHhnFV1RVDtaK9ie7cCv3LnVt5Oz1/+r8kq2wjBu90ciG:1JoVnZBHxFtaK9/vZtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552557, "uuid": "29b5e994-2cfc-4045-af58-e3778c917ebe", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552557, "uuid": "90f43ead-ceb3-48b1-913a-076656564522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552557, "uuid": "9f131a5e-ffd7-4dd5-904e-385f5cc74b1a", "value": "winlogon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de46eb1-9374-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488746, "uuid": "c7757466-ebef-4ad5-a8c5-f1b2b47f87c0", "comment": "Malware payload (Mirai)", "value": "2c5b4e6735fa246cee9d03758ecf9334", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488746, "uuid": "1d865539-4cc0-4321-bf4e-b0c464f9560a", "comment": "Malware payload (Mirai)", "value": "d0d85d52e09a2fb37063d3e19761aed5df26361c5a4d1d7a67e50ab6f84755c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488746, "uuid": "997ccc7c-c5f2-418d-8dac-9c564019f5a4", "comment": "Malware payload (Mirai)", "value": "99fc20453a87df4acbabffd65e839468f29c2428", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488746, "uuid": "b2545a0d-97b3-4913-8620-45115dc54249", "comment": "Malware payload (Mirai)", "value": "721effee2e516ac8e00f99f5cfeb67c441a5fcbc72f853bdf789a769d54568d753c0dcfa3c5f761a0e44ba81416bcc11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488746, "uuid": "fafa9bb7-ff39-49a9-bd4d-845575fb2de3", "value": "T1C9639E72882D1C64C1558270B0B48B741BA3F018825B5FF50DEAC368A86BDFCF6597FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488746, "uuid": "e748d6c1-6a94-4ca8-8648-3582fdee323b", "value": "1536:dNu6M/jUE3Of9075ZzuUEKZsl+wkyPF4CPI0:dDM/jUEe+7LzuUrZbyPF490", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488746, "uuid": "db1afb5f-9b9c-4bfa-8951-3000f2fffb2e", "value": 69076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488746, "uuid": "4e440d62-f85a-4940-9651-1d0f8cc5ff4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488746, "uuid": "a302443e-f0f0-4a21-8819-fff983a819a2", "value": "2c5b4e6735fa246cee9d03758ecf9334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc24564-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492073, "uuid": "dcd23c09-eb79-4fa8-b90a-59c45e4ecac1", "comment": "Malware payload (Mirai)", "value": "2d4022c8906be9808436da6fd6751718", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492073, "uuid": "6cc4f7a5-7f58-4f0d-854c-145729381f87", "comment": "Malware payload (Mirai)", "value": "d11dd2492bfa92ea7e5ae5cdac469211f4fa3489afda71f79e66519e7235f9b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492073, "uuid": "f72613e7-702e-4313-a541-e20b825ce314", "comment": "Malware payload (Mirai)", "value": "f41654359060e45f4fbd870ad76dcdf061a5e820", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492073, "uuid": "56f93a81-439a-4a24-adb3-2e52fd088653", "comment": "Malware payload (Mirai)", "value": "409985432c842f35a299b808a360c2a05235bbd024ac505e3db11a3b5248666c799a6669ae8f9d9cbfbf6925572bb28d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492073, "uuid": "c9e65fb4-9c36-4321-8744-e8236812f347", "value": "T11863AE33C8145DE4C1594274F0B98AB41B63F418830B5FFA199AC3789467EBCF6AA3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492073, "uuid": "a7a23e7b-b918-453e-82f3-948083bdc21f", "value": "1536:gvcuzUgLD2H296Zw61gKMX2kXhnwcXCZjP:gzzUgLD8Yiw61nMbnwcXcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492073, "uuid": "67b8a7f2-3941-459a-9518-cfc092fc1a78", "value": 67004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492073, "uuid": "7ec6308d-def6-42e5-884c-32d25296886e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492073, "uuid": "113f457e-04d2-443f-8b9f-c3bb67685584", "value": "2d4022c8906be9808436da6fd6751718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c00977e-93e0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645535236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535236, "uuid": "9bec2dd4-679c-45a4-b2ad-16b297145c7d", "comment": "Malware payload", "value": "11c83e7e3aa22ba0c3b1c1b91b0cf7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535236, "uuid": "7695378c-92a6-45bb-bbdd-a496b0f92128", "comment": "Malware payload", "value": "d1555374d0c7eeaee2fd864d043a9c3269ce5bd41b4420b0bfca73f07273812d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535236, "uuid": "51a1a46d-816d-460f-ba29-81921300ff1d", "comment": "Malware payload", "value": "5732a442f1ab140ac499a4954ef6b9cf4b911c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645535236, "uuid": "403e9dc8-1bf3-4e5d-9e96-61ca1b06395c", "comment": "Malware payload", "value": "30fd0e93141b4fbd810888a9bc202868962124b7254fe03c7a14afad6839bdc9b55adfb40740f10ceae92e0b6d3303ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535236, "uuid": "01d2fcf6-5584-4a1e-a0cc-28c1a755be52", "value": "T1CA64230BB2CAC9F7DB1A2B300D23C75F8BF969142715171B6F086F6168252E19BC61C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535236, "uuid": "1ed697ee-451a-45e1-84a5-ac906c26e45c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535236, "uuid": "d717cb26-a128-449e-8d02-b1d84255558f", "value": "6144:owuAheNGtGdSaOWsn1XhTXHUfP2sHsg2z4f1zMaPk2WObCRywFWV:Rhaqf1xnfDHUfP2Jg2z4GaPVWScyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645535236, "uuid": "cb050533-87e0-4ff9-b37b-98c646e8073a", "value": 324509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645535236, "uuid": "83934465-e1b5-4ba8-aa8b-49d71eaccb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645535236, "uuid": "5046ab00-ed8f-494f-82e3-097410c9e1d8", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843adba0-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "4ea61308-5e21-470a-ac1b-73abb417ec19", "comment": "Malware payload (Heodo)", "value": "5cfbf96f868fb1a8ee28e9f76f2fc449", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "6b907370-c42b-4867-9371-94b06f2b4912", "comment": "Malware payload (Heodo)", "value": "d239b7fc61594e830b5bb3cd777752a4599f95ee6d107b5d92e8ffc77c35e6ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "a406cd54-7363-4df2-874c-a8e6c13df200", "comment": "Malware payload (Heodo)", "value": "33c7455e6485df2f2c0d54df3d865ee084734e68", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564939, "uuid": "357a404d-2860-4dc9-b986-185ae7b87fd2", "comment": "Malware payload (Heodo)", "value": "08d5336406e4c612196557e768b0c441db3a97e622dd5f5c6a44520fc49906333018e5329ce808ca2e6cdff79eef9937", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "c32ba60b-f7c0-483c-83c8-57f74ae5f3b6", "value": "T1B7B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "df4b1b05-a49e-4991-9ec1-42f6979e6776", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "536c452c-f00f-4cde-bc15-958978af5598", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wVIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWizo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564939, "uuid": "c0efa76b-650d-4b0b-81b4-94e30cf91cc9", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564939, "uuid": "dca45f73-b0df-45b1-bc54-a1cc2fc0ae60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564939, "uuid": "05324e81-80d6-4f9a-a855-4bc24fce007a", "value": "emotet_exe_e5_d239b7fc61594e830b5bb3cd777752a4599f95ee6d107b5d92e8ffc77c35e6ee_2022-02-22__212214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523de728-938a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645498283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645498283, "uuid": "8186d0cc-6f32-4e14-b62e-143901b6b9f4", "comment": "Malware payload", "value": "6f60c02deafde876286a663aee6f3897", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645498283, "uuid": "f52ba273-5991-4134-a5c5-91a52eda7f6f", "comment": "Malware payload", "value": "d2b4a8933ebb7299155a039e4582446b21a76167814100862818697dd02c20cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645498283, "uuid": "49d682de-0791-4472-b750-5fc605ba7212", "comment": "Malware payload", "value": "f0fdc5b981d18e9d846ec2513773672f01530347", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645498283, "uuid": "ba151b6e-6b19-440e-8f91-e25346761d5b", "comment": "Malware payload", "value": "221157eff8ac421a7fddbae2fa3ac01fa42d22ac08dcd94f8061d5a50fa8fa6d461ecb4972eddfec887c41e9b0a9ba3d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645498283, "uuid": "1a1b1178-1e34-4082-837a-e3499ace9f29", "value": "T1B7A2A5157911D69FC7AC08719CDA9FFB26712C05AE89BB0BB668BB6C2C3F750D702600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645498283, "uuid": "ae718e51-e6fe-4177-a501-b091d6bbcf04", "value": "192:93KiHXUMipxBFXUY0ESUWIVdD3NJqvAZ9ix/xafmT/p8s8HPDvJ+wbD4GLfLoLyG:USEJPUn9UWkhInaOT/Sd7bD4GL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645498283, "uuid": "c22053f9-01c6-4fbc-996a-6d8fe3c124f3", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645498283, "uuid": "2cecb6a2-deca-4ce4-ab8c-82cd509c0aad", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645498283, "uuid": "6203eb21-2aef-4fcf-af77-c2112a2e9964", "value": "SecuriteInfo.com.VB.Trojan.Valyria.3942.29598.10656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d0164e-9426-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565240, "uuid": "7b3fb330-179e-44bf-bc66-e084dbf72a32", "comment": "Malware payload (Heodo)", "value": "37dcc67ff52eeb87ac498b13de2939b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565240, "uuid": "1a91ec71-61df-4e68-a288-7f9109d450a5", "comment": "Malware payload (Heodo)", "value": "d2e038443124f1d06e05af379a1c0a29d557d3cb79a59db16d1fa4b50cfa7a17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565240, "uuid": "38800816-18d3-4662-aadd-04971eeb1058", "comment": "Malware payload (Heodo)", "value": "e69f81545ca516e67fa04667909dc46073de44cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565240, "uuid": "d84e556d-70ed-4f93-9033-789709af3553", "comment": "Malware payload (Heodo)", "value": "c6ac32daea601bc3d088d9c90e4b9aba01dcfdf6add8369cb128b7ea90ab7ea985d4b9bcb017b61c73de1f47e225b976", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565240, "uuid": "2bf7021f-3fd4-4348-a5b6-cf0ce315fbd8", "value": "T115A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565240, "uuid": "5937fe76-aeae-446d-8f89-b575bd647eaf", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565240, "uuid": "26a53ea7-6459-4690-9c71-32dc1ee4fa21", "value": "12288:vicw4w2Vb0zq6k5Z2mTmjqkGXNrGHORQuBT:viSwub0W6LmTSwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565240, "uuid": "5059c508-e245-46d0-abcd-672716b4656b", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565240, "uuid": "a780b6c4-85f3-468b-8a95-0e8ea0faf8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565240, "uuid": "b1b2dfaf-e11a-4eb8-919b-c56a29055c5a", "value": "37dcc67ff52eeb87ac498b13de2939b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449c593a-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645513722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513722, "uuid": "12f78842-6244-4451-98a2-8225b93fe891", "comment": "Malware payload", "value": "86afe71b4978718504dd58e59ad1eefb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513722, "uuid": "6ad5b916-18b2-4c1c-afad-8ef14fba5f52", "comment": "Malware payload", "value": "d346bfe5d2f6b12e7d25d0aa5d65d1c692811624b373905b5a6ed05209e53198", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513722, "uuid": "a07a8306-07ea-4d68-ab1b-674028df8876", "comment": "Malware payload", "value": "3d8ead3acdda0d8166170190d34d2fd6339262ad", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513722, "uuid": "fc56b288-0904-4f15-98ff-f08b4603defd", "comment": "Malware payload", "value": "b098d55b46dca12ce0939d8838010829919ab16a9222549b642e373a6e18d9b440f135d80fba905c5143e847e9842985", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513722, "uuid": "020c3997-2c55-4187-bddb-f0454bd99d7a", "value": "T17F45120A31C38CC1CB99933510D6FA3E96D4BD85BDE19583B6FE3E0D73B59846A83219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513722, "uuid": "df5b4f78-9f04-4b01-b249-fbb5422f7ffa", "value": "24576:2LILVHyUt7yQaaPXHDldejhek7dZfNifbOR+cQlm80pLr:2s5H5tZaaPHDl/kJvifbOUcQE8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513722, "uuid": "1e9ac52e-e7d0-40ba-b15d-b8229e96f6b2", "value": 1231935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513722, "uuid": "aa017bbb-7b90-46d4-a460-0dfb4b4efb2e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513722, "uuid": "8a97bb70-3b23-4faf-acae-9db364e4e918", "value": "Revised 2-21-22 Race Sponsor Form.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26060a84-9410-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555761, "uuid": "1b528edd-1025-4dd2-bd75-9a9b39b9c915", "comment": "Malware payload", "value": "d2a67c3c6e653188c308c1cac3afcc59", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555761, "uuid": "5821293f-7ccf-4422-b5d0-d8e62bf754b3", "comment": "Malware payload", "value": "d381cabf534a949f018d01e5a157d2ac751dc5729e761371ac3fc00f1bd69cde", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555761, "uuid": "1e7febaa-b6ef-4bb6-ba29-2952c556a86e", "comment": "Malware payload", "value": "9bb92cc080fe817a2f5d7951bc4142ba36712a3a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555761, "uuid": "0469d966-682f-4ef1-9323-5ab76aed86b5", "comment": "Malware payload", "value": "758258dc9a73b696d71636e7ea2cea35bd546268de5eca8d5d0b00c9dba697648ae39fc49fd7ee9af32b8fed6e05b9dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555761, "uuid": "5da7ffbe-75cc-4e74-8165-7c44bb84f994", "value": "T1DA930769B681C95BCA5807344CD7CBF67227BC424E7987873258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555761, "uuid": "f78596ac-ed96-4322-b02e-950ca8f4c436", "value": "1536:Nyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQxEkWvgrPE4nWHPNc2A1:Nyehv7q2Pjx45uoDGTj+5xtekEvi8/d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555761, "uuid": "64e8015d-c285-42d9-b5bd-6cd7d0c0968b", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555761, "uuid": "0a0988a4-4efe-4471-b5cc-4496a2d9f433", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555761, "uuid": "07330de1-57a6-4994-a86e-73b3ab948476", "value": "tmpzuf3qcvn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36131f4e-9408-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552352, "uuid": "dd5caf61-add9-4367-a204-e6bbcb59ec23", "comment": "Malware payload (Heodo)", "value": "4cebad1d31682b18318afc62354c19c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552352, "uuid": "50d67a08-bdf6-4977-a73c-a53149abc132", "comment": "Malware payload (Heodo)", "value": "d49c2a0e11d30da80121cc6cd51d37cc3b7cf403458abc3df01b1b577aa88c6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552352, "uuid": "368e81ab-4a85-4865-82bc-fa18e9ef4342", "comment": "Malware payload (Heodo)", "value": "85efad2225f9394962f4be6957cd2833599ef57d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552352, "uuid": "b977adbd-20da-47ed-a6f2-70626f77e058", "comment": "Malware payload (Heodo)", "value": "c07fd4148ab7c39b0f12546672be609077f8fa6c81b7a7e756023e1ecea2f3df5a22e6ba503fd5cb9c600e55c5cba922", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552352, "uuid": "22780b2b-3790-4732-8afb-93f9290d79a6", "value": "T1BAA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552352, "uuid": "a269998f-773b-4fe3-ba48-be565d489122", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552352, "uuid": "43041475-87a1-44f8-9e11-8d21d89093c6", "value": "12288:vicw4w2Vb0zq6k5Z2mT/jqkGXNrGHORQuBT:viSwub0W6LmTpwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552352, "uuid": "ded17a2a-5a99-4dbc-8601-ed3c4992ce12", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552352, "uuid": "dc93dd42-5c4b-4908-a517-639ba372151f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552352, "uuid": "90d0209b-327d-44fe-872f-283d26ba7a45", "value": "4cebad1d31682b18318afc62354c19c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee36742b-937b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645492102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492102, "uuid": "04bd6aff-5ff4-4a2d-be23-20480a44184e", "comment": "Malware payload (Mirai)", "value": "89e9617e98b94b50908aa0f62e3ef986", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492102, "uuid": "73844be9-f335-47df-b8bd-36e0e94f1655", "comment": "Malware payload (Mirai)", "value": "d50bc4e2611a75c9d720f71f56b98ed7ecd0687f0fb2e5773044293a25d55baa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492102, "uuid": "5f94e0fd-bef0-446a-a84b-81ba70c2a517", "comment": "Malware payload (Mirai)", "value": "867c99ba102507a7a5907daa71d2cc0b9123f52d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645492102, "uuid": "1f0ee72d-fb10-4e04-846e-e54a0a0dc706", "comment": "Malware payload (Mirai)", "value": "f544ae416a96734090089a9d3a1e6f85ddbe434d6a3dddf34dbb71fe0428363081ca452a1507c6c84e14756dd5ce7926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492102, "uuid": "e1937a83-ea9d-481b-9918-24e8d19b4c3a", "value": "T145F2E12050529AD1F63748B302A903148F968DB7E042ED079784E6F7DF507B5E8B7A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492102, "uuid": "fd01ae94-9b23-4af2-a9ce-8374b08127b4", "value": "768:zrtgGzsIg/TtVV580QnSSa+9yAO8zPk2XxInu42JgGlzDpUYsup:/Zzo/TN608BI8zPSiVqYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645492102, "uuid": "59adbc7b-40a3-4260-a84a-1b23be399966", "value": 35360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645492102, "uuid": "8f807ffb-80b5-437f-a5f4-2597f60d03eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645492102, "uuid": "d6a4b1a7-07e6-4d34-b873-25fddda2eb25", "value": "89e9617e98b94b50908aa0f62e3ef986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4a5571-93bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645520260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520260, "uuid": "80c54844-1077-4705-85bb-dd8a5af03a01", "comment": "Malware payload (Smoke Loader)", "value": "fe15501b25c16490cc9752812247c104", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520260, "uuid": "88ef9b9e-6eeb-4519-b515-6dd3b38327ff", "comment": "Malware payload (Smoke Loader)", "value": "d5ca25f68c37ba0a18d0349324b9be079bd85f3a67486bad43c20f745363a475", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520260, "uuid": "c3d76e67-01ce-48e1-a921-1b07d720aaee", "comment": "Malware payload (Smoke Loader)", "value": "bd589bce47883ca7fd6da170adcb6bc47d07f428", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520260, "uuid": "ee2f1c71-3b30-4a66-9698-a3b3cacb1655", "comment": "Malware payload (Smoke Loader)", "value": "5cdb3b164a4de333385747510de08817468c6569ad7eb74a113da92042943c10b82163b6e3ff5c66928f5777e132d49a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520260, "uuid": "1f5e238c-bb7d-4eb2-8ffc-f55861036032", "value": "T142447CA3F448DC39D016883D0422B4A102E57C141691577ABCE5BBEDDAB22CF27A7E5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520260, "uuid": "72f9bc62-13bc-4a89-b3a7-6763f8d2083b", "value": "48e807a7b58ea2b8edb6203daf32ec53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520260, "uuid": "244583fc-e4de-4697-8b45-de120cf25000", "value": "3072:3Wum2MgTz/36bIy+jrAyxwLj0hqUXo2qoTyIm2M7WA:3fmRgXeb+jUysj0AYFDeImR7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645520260, "uuid": "7e7aea77-9780-4f2e-81fc-6f9979545d9a", "value": 255688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645520260, "uuid": "735f6518-ee71-4ca8-8f13-4dbc487e4f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520260, "uuid": "a292d7e4-c3b0-464b-b211-0cf58605184c", "value": "fe15501b25c16490cc9752812247c104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f0c51b-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528144, "uuid": "235547ad-1758-449e-8622-d689b78d1d82", "comment": "Malware payload (Mirai)", "value": "5561f27e721b701ac84ea64bfb47c205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528144, "uuid": "705ea055-d9c2-4d0f-b27f-58409b8a76fd", "comment": "Malware payload (Mirai)", "value": "d5e724d9abcefdb70d21f09f00ee0db1da5ab6c11df1165ef5e3f5fefadf86d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528144, "uuid": "2a6c7e12-fbff-429c-a87d-6c799997625d", "comment": "Malware payload (Mirai)", "value": "853795040fab3b8c1e01a290ae5a84836643576b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528144, "uuid": "e278aa00-aaaa-41e2-97cb-4debb0d02ba1", "comment": "Malware payload (Mirai)", "value": "b585e60b02bd7dd1be88db67cda1496c2cdc2a722e9a1c527e8fa20f3e88b7f06c82eeff9d13c409a629d67911295636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528144, "uuid": "81fcda2c-6708-4410-a0f6-7bf0527795d1", "value": "T171435DD6B401DE7CF94BEBBA80214A0AFA35721154A30F27B267FD93AC720564C6BD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528144, "uuid": "2ed8806b-a854-4434-8538-1d36f1b7efad", "value": "1536:3tCdFUWSi7sSa4lPwL+ICkVnCSQDVB0dI8M:O7sr4liLxuBSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528144, "uuid": "ca4623c8-fc34-47d0-bc28-17ab92b1521f", "value": 59724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528144, "uuid": "e12c905f-467a-4a74-833d-480b71ce1e2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528144, "uuid": "05426227-ad31-4b2a-a7c1-c7fa9d028d90", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41804ad5-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517582, "uuid": "49dcd343-0c5b-4ef9-a9ac-bceb86d021b1", "comment": "Malware payload", "value": "d2cb8d67710f1d5b7fc2711740ed0259", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517582, "uuid": "0e1e11b7-0fa7-4b56-965b-5a2deec001ee", "comment": "Malware payload", "value": "d5fc938301a121c3a7c83b20903a28aab2147cca2b29c8ef16a2879ce5224e45", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517582, "uuid": "59d42574-28f9-4c35-895c-7199a5c4706f", "comment": "Malware payload", "value": "24a058c42d3db1eab21f06cd2867748d1614a87d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517582, "uuid": "d5648b68-d955-47de-999b-98d825ff65cf", "comment": "Malware payload", "value": "2e82b7a2d2e1061df9106e8973438cdc91f588d5b740dec53cbbcbdbc4fd91138b635b3ac91a12c000b0397aef0d7db3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517582, "uuid": "183535a7-3d61-4a7d-b3d8-91d23484e7a7", "value": "T14A547C07B3D7427AE5D74732278B9362DA32EC788622412B1249790E3DF1594B7E72F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517582, "uuid": "77c784f0-5139-4ee4-9340-4b93a78b1824", "value": "3072:XB97NIA+/WQx5TYD9yOePn75N7Agwgz88ereWn/7w05g0a9oYl3DaAXFOpc53E:Xeb7Ax8er1nzTxYl3DaAXFLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517582, "uuid": "dafc56c7-2d1b-4e75-b597-b7adddeedf61", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517582, "uuid": "72daeaee-c2be-4b97-9041-d67c633c4e7f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517582, "uuid": "38340401-f87e-40e6-be06-7a70c3ed60e2", "value": "$-NFe_~o29.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75951b5b-93f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645543869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645543869, "uuid": "3b2f8d35-5bc2-4866-9b26-a53e04b7c35f", "comment": "Malware payload (Loki)", "value": "97afa7cd76301c33a2f5c239f03a9973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645543869, "uuid": "407814d7-3c20-4445-b50b-ccf6df169232", "comment": "Malware payload (Loki)", "value": "d7187929900556d8d5bdce069527f8649e36e52498b210ab2b6fa5f89d85aa28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645543869, "uuid": "8b572014-00d1-49b8-ab55-bdc44e6483c1", "comment": "Malware payload (Loki)", "value": "f711ec695e74708f1c120717b663d55809f59b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645543869, "uuid": "9a970782-0855-4c4f-a43f-d8747c014884", "comment": "Malware payload (Loki)", "value": "0322e3cb30f555b163b167442e219101f269f09838129da37a2192b6084478d29e753713c0c65bcf0fc7314cb98816ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645543869, "uuid": "e243ae4a-d266-4e56-abba-b995048b0318", "value": "T18E34123DB0D1B8FBDD8382B425B7AB59C3F762013670599323980F097C3E94A6651AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645543869, "uuid": "6231344d-967e-41c6-b6e4-53328bc4e1f0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645543869, "uuid": "841bae66-a6b3-47a6-8033-472c4d9e89f8", "value": "6144:TxDism6/nzvxC03pJueyScYIgPGLSbjHPfvd6:S6/z53Huez/dbjfd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645543869, "uuid": "d78fdee5-7832-4e50-b0c9-bf56848f3c0c", "value": 232214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645543869, "uuid": "8a852e84-732a-4efc-9216-337be30d3e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645543869, "uuid": "9f06749b-5066-4781-a39e-e89b061a193d", "value": "97afa7cd76301c33a2f5c239f03a9973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c15ced-939b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645505797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505797, "uuid": "178b2cda-9cb3-4a84-8aa8-24102ee7430c", "comment": "Malware payload (Mirai)", "value": "0b877d9c0b6dbf93d8b8d718fb2b0f4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505797, "uuid": "d1ec4336-e81f-441e-815b-149d47784338", "comment": "Malware payload (Mirai)", "value": "d751ead2e032d096970250a5f9fa4ce94aec5e7d1d1d1de1107acca70b6df59a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505797, "uuid": "a87a1459-eb0a-46a7-892f-d9e62f6cafd8", "comment": "Malware payload (Mirai)", "value": "405b8508fd13e314447e95a50de93c1e19bb7a29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505797, "uuid": "6e46a163-a2f6-4b18-92fb-e6c4119908b1", "comment": "Malware payload (Mirai)", "value": "3c64bc6fee614688b5479ae2f4a587a3ea0a5000b85fba899de1e21d791b2337a2dff6711a022e5ad002a81d39ba7403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505797, "uuid": "f83feb79-6cf4-4f24-82cb-121c5b382679", "value": "T16BB2D0E151CD4062CFBFD07BFE184BB911366B243B966539CE9CAAC683B23904217CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505797, "uuid": "c685fe07-ea8a-4cea-a5ce-786f613845a1", "value": "384:Mk9ZE9fVvVhmvG/jf9/uXzST0AZWH8nJwqqCnQ8rUg+QjV+pj5BoPFRUtrG7fiOD:X9ZErjf9SuQAZw8Jwq5Q8Ig16cRUAi14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505797, "uuid": "a0a68509-e2e6-49dc-8fbb-352b98230b36", "value": 24496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505797, "uuid": "20897edc-e047-4d81-8cf6-d378704cad38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505797, "uuid": "1a076804-e95c-4181-93df-37b513b3f64e", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.19861.3862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec44735-93b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645516182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516182, "uuid": "feeedfb7-1956-498d-bbcb-9d6138ff25ef", "comment": "Malware payload", "value": "8fda405ff058aeaa07f08467d2050b22", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516182, "uuid": "faecd8f3-39e4-44fb-ac83-45cfe27a5c7a", "comment": "Malware payload", "value": "d76be002a9bf62f8cc53ed0a4ccef9c7c5fa0ab28c06002defcf1ece981a1a2a", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516182, "uuid": "ff85e5f1-b973-4c51-a20d-9dc1ad05a8e7", "comment": "Malware payload", "value": "22929a6dba4853f612528597e191c0e6ed110079", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645516182, "uuid": "9d610846-a1a3-4ca0-aec6-ce148223c910", "comment": "Malware payload", "value": "46cc4d4153e63463b99c564bd38bdf15843c5484136dbfcb4380089b6b0fb8b5c516a92e95b9b13628297f5b5e2cad4b", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516182, "uuid": "329a6b63-cd77-42ab-a92a-eb0932aae998", "value": "T11223CF1CC5422606C1A3693EC47D94D509AB8C13B51545CFE6FEBD8B0BA4E8B274EBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516182, "uuid": "503ca4ab-f16d-4301-bb9b-a7656426c6bf", "value": "768:J+oRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTo:J+KJqHt7NJECQFfqA8GCqKiV1/K8Nyt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645516182, "uuid": "6003418d-5307-4569-a86f-3d1d29bc1795", "value": 48030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645516182, "uuid": "a1e6a353-0d63-4255-ab32-cdc94c390046", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645516182, "uuid": "cc7c94ce-c7bd-42ca-bead-7d6542d75063", "value": "Payment Details_PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb959b3d-940f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555583, "uuid": "3873311a-11fc-42a3-953c-c3e725fc59e2", "comment": "Malware payload", "value": "4aaf7ed23d257be8972dc531cd4d4bf7", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555583, "uuid": "33fc1750-3423-4078-a0c1-77c711dc14e2", "comment": "Malware payload", "value": "d86871d7450b17f792f2f344d486b1482c777ff65182c477edec0e0050c0a600", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555583, "uuid": "15032d5a-222f-45b6-b7b3-06541e772fe0", "comment": "Malware payload", "value": "33b6f5cbe51028a7b5955e6f60f093424af2725f", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555583, "uuid": "7a4477f9-c513-4417-84ff-0006a5fdd143", "comment": "Malware payload", "value": "a674433718eb7cb7ae5949fc4cb266bb983bd6ea767b5475a3da4b0c104014dccad13a3d6fc079f9c0f3ac9ae99141f3", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555583, "uuid": "a9503968-ac4e-4151-8904-ed9fbf26b1c9", "value": "T10F0301E8055462AED3A321E0AF1AF0447A2BFA2518F1D4E434DFD3BD60BF5DCE522522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555583, "uuid": "b6507de4-506a-405a-a66e-7441c01442dd", "value": "384:VRgKf/XbrN7vQtV6nEFEpMoATi6rGs+ZAUw5PTsxCY4nMNLoJ0WE:VRgKfldpMFmqUisxZNLoJ0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555583, "uuid": "cdc3444d-254b-4db5-8b4e-43b2fcceee3d", "value": 40016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555583, "uuid": "4b631950-2704-4a8e-8121-67d2e800e222", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555583, "uuid": "55a804a3-680b-46a7-9ff5-7cc7da9e170e", "value": "Bt0CmBR6dVoWhbYd0MysWuV5LKOmpypn8E01oi16ES4qOo3d.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823b14d2-9397-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645503947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503947, "uuid": "ef73cf21-3d41-41d9-849b-d17aa18b8aa8", "comment": "Malware payload (Mirai)", "value": "ba3293a6c57d3bf319494e7f0dd106ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503947, "uuid": "314ce538-859e-4636-a452-6f8d481db9e6", "comment": "Malware payload (Mirai)", "value": "d89d130ecd40d99f7641dd36be18dd5d7b540593a5be042839dd78165e1e3148", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503947, "uuid": "f11cc689-1b46-40c6-8501-c3f44e951905", "comment": "Malware payload (Mirai)", "value": "c3557c9047e772296f5aa7f48e15c28f1583e01f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645503947, "uuid": "0d56c4bd-eb1e-44e8-8ced-dcb0f6166f1c", "comment": "Malware payload (Mirai)", "value": "7d3ce2e852e40a0818efaf9929f511b03ff6950c97ce9a7fccf0f9268fa83b64b6c86c0f2dd64dd95f0614ac4f61f603", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503947, "uuid": "0f6bd843-7a30-4872-a110-60d85a164215", "value": "T11523F1BC040288C5FEBEC47536FA4311B9A60FE1B845D814E97EEDC38E23A7D6591594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503947, "uuid": "7b7dfbe2-641e-4a0f-9e27-8c1be760ee64", "value": "768:mZnTYZk3vZUYO3siXkKWAa2xQhEvcOzncm9oBuKvkGWUDy8pfIfDunEPiEoMwLJe:wTYu3vO3siX7WAfxQKUOrHyBuKvZNDPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645503947, "uuid": "c35ce3b3-7b97-4f27-9b2e-15296c9c490f", "value": 45748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645503947, "uuid": "639d189b-48fe-42db-b872-16afebfdcbc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645503947, "uuid": "a128b346-e308-440f-ab2b-d3541681010e", "value": "ba3293a6c57d3bf319494e7f0dd106ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fee427-93d7-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1645531575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531575, "uuid": "a4c76686-aa35-4335-8ab9-e8dba9d27189", "comment": "Malware payload (DCRat)", "value": "bb456f49494562dcf3c598ae0b5d9905", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531575, "uuid": "5ed238b5-b5de-4d63-9fa4-360dca8d7c9c", "comment": "Malware payload (DCRat)", "value": "d8e760c2687a69e89a5ed0f9d577b7765471d4a16fca56ff87e1e1d246f380fc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531575, "uuid": "9bc3cc99-a583-4595-86e5-3def90c8b7ca", "comment": "Malware payload (DCRat)", "value": "3da0bde8fb5f2a7a14a655bc24909e906b04fee0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531575, "uuid": "92984fc4-3d30-4795-9dd8-a160e4e1afce", "comment": "Malware payload (DCRat)", "value": "73c593bb44ec6b2a0e38d5c83b4e0040345ed45d9d8304297c75fa3dc0b0fec4811293c4934e4bfdfc20c4233664c42b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531575, "uuid": "e110d8bf-7e2a-43d6-809a-ed49476652d0", "value": "T122654A067944C931F06B1637C9EF701553A8EFCD2A2ED6DA7E9E375C22213A25E091CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531575, "uuid": "b42f6827-dee3-4458-9254-02d8bf22fa18", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531575, "uuid": "74131231-c300-421d-a605-34d533c953af", "value": "24576:M2G/nvxW3WwYopP8J4qfKLoSb5U+tA5TRKQSVzx8MAZspFI:MbA3ZpP8Libil2TAgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531575, "uuid": "8514db9f-6ca8-42f8-9c01-af5ae6fdf055", "value": 1437340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531575, "uuid": "4c0e5c9a-8fb6-4256-9b3a-65a9f269a21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531575, "uuid": "bae0bf26-701a-4249-978d-9ddd27a8654a", "value": "bb456f49494562dcf3c598ae0b5d9905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957d98df-939c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645506127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506127, "uuid": "6c8b699c-e639-47a2-8ce3-bef07b947dbd", "comment": "Malware payload (AgentTesla)", "value": "6b853461212ed0deabef82a09573f948", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506127, "uuid": "3c5d260a-4421-4e06-98c6-8551cf25aec4", "comment": "Malware payload (AgentTesla)", "value": "d8f8ef0e454f26e247e205479572b4eb44a6b7a474851ced52faa951eba62c2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506127, "uuid": "1d7726c7-ae9d-4ca4-889f-00dd1218293e", "comment": "Malware payload (AgentTesla)", "value": "c4fb0f40a4c769d00d32bdeb34737c89fe305349", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645506127, "uuid": "127a235f-0086-45e8-a996-2481b1f9c21f", "comment": "Malware payload (AgentTesla)", "value": "79532f9bc362536377a2f6884719803235128eec121591c3d8500e27291a64c5fee801ecbb6686e2f9dfd554bfa710bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506127, "uuid": "90359962-afbc-4410-bf28-8555c948246d", "value": "T163A401A278C43AF9F4B5C47182A7559387E1782B0191399E876C8BFF4492843D31FE6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506127, "uuid": "030b3ef9-f1de-43ed-8c20-8438e5e83751", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506127, "uuid": "a4269855-44a8-486e-b8e4-2ed13bd223d0", "value": "6144:1xDOsKokDpcBnIJR2kaFZCz79pEhgzFSwgshUecn3+tNUnXfU+6V1/SW8ztMKKoH:E++R29FZGzEhgxAnutqBiS55Mcwcm/Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645506127, "uuid": "6d1b081a-c3ae-408f-99ba-9fa290b16b2d", "value": 470613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645506127, "uuid": "17c9d83f-4fea-4488-9a35-de910e7a6472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645506127, "uuid": "95a09efd-eb37-4787-9cb4-7984a834c951", "value": "RULES AND FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79b537a-93e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645536705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645536705, "uuid": "6eb99694-2de9-4871-87db-d68f35902c4b", "comment": "Malware payload (Loki)", "value": "21bba230879fba436ba0967fecd3c126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645536705, "uuid": "d8700cf9-b90f-4dfc-894e-03533866beb7", "comment": "Malware payload (Loki)", "value": "d916db2d430e2670b9e6a5995681ddf48c789ce1dcfaa3c0a02c0e8fee2f4123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645536705, "uuid": "356f2fa6-95f0-4513-8dbf-b547058d5895", "comment": "Malware payload (Loki)", "value": "0f3039ffe94b59c4347096d01e228124a99d83ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645536705, "uuid": "adc6b210-2024-4eea-999b-d0d29c626d76", "comment": "Malware payload (Loki)", "value": "2ffaeeb20e2ee5faa0f5353cfd835af7c66cb8f26212bf227c44fc72cca0d35f9157910ad4b17fa3f535110f4ec277f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645536705, "uuid": "08144ce5-353d-4fab-9bbf-dc581500693a", "value": "T18134123F36C05837E0AA12B9D97B67F9E6BEF11157E1060B93691EEE7923103950A1C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645536705, "uuid": "41e33c35-cd53-419c-a8b7-44093f725372", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645536705, "uuid": "614ffa73-729e-4f5a-89e7-b36489d52f06", "value": "3072:Tx6UW6tpmJcJ09YMRSVxqdp6URNpmWMs11cNInEC8eVUKSlTBEw4HGVeZPCBYhiA:TxDDBwVNp7BcCEC8iS5Bqp6yhF03Bu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645536705, "uuid": "0c136e40-afe7-4ee6-8400-d663f33195ed", "value": 235230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645536705, "uuid": "93cd43f4-3001-409b-877f-1a4bd44a9d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645536705, "uuid": "4add5366-c0ce-4d04-ba69-e68b630a8ecf", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5caaf2a-939e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645507147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507147, "uuid": "d70c1275-6612-40ba-9033-1367a5570931", "comment": "Malware payload", "value": "fb3716aed4d6f3c01ea8311183e3306d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507147, "uuid": "a07668f7-6db6-408d-a9d2-12aff0333d9b", "comment": "Malware payload", "value": "d9310f00e3f94902837fa7d83500549e491a1a00a0d9f29c9880090f7b73d738", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507147, "uuid": "4f6faf2c-39a3-4f40-b8d9-85809d90db66", "comment": "Malware payload", "value": "63f3aeff1f0eab34c1111bf46b75055b07897941", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645507147, "uuid": "fdde617f-a10f-44df-9699-c6099f2183ac", "comment": "Malware payload", "value": "0a021774c34b3feae00c508f5cd7ac30f72a23be4de1cffc893b09c01812c8c8d99952961c9b1cf892066a7e177a5f36", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507147, "uuid": "88b36030-9654-422c-8800-bb0144599d39", "value": "T197923A21B7635271CEA92B738852454003B6D34E6673AF9E7C8C2219DF237CB0BA2F55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507147, "uuid": "9e4bc2e2-6142-4571-b075-750ebe812448", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507147, "uuid": "52de4565-6677-4edc-b144-8f2fb0727916", "value": "384:edG1XhUarfYjJJWoN3/vqh3MNygxff9vwEG9/XwJwq6uJfq2GSLwqW79:eda6aDYjJJ/NXqhvgC2GL79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645507147, "uuid": "38464271-443e-43f0-bb38-a4e9a1bb0b01", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645507147, "uuid": "08f5df4a-6dfa-4a3e-be9d-d580045192aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645507147, "uuid": "6ba6653a-a071-459f-b8ed-747c5c821a73", "value": "AuroDuLO.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed1db0d-93d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645530570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530570, "uuid": "2c51bc37-d99c-430b-959a-da80efa2229e", "comment": "Malware payload (Smoke Loader)", "value": "712719dd8eda4191e0658e0e213c9c98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "sokdikksiiefgsdf-cyou", "colour": "#909DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530570, "uuid": "fd776c24-bbad-465f-836f-d90224597bae", "comment": "Malware payload (Smoke Loader)", "value": "d93adfb94ccbcc7b2bbd5fee9039d93107c113e48b5980508682111dffcd0316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "sokdikksiiefgsdf-cyou", "colour": "#909DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530570, "uuid": "4bc381bd-2bd1-4e24-bdbf-de6c92f898d9", "comment": "Malware payload (Smoke Loader)", "value": "3a7d8ae34185ea8ec3bed131bd957284e26aacd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "sokdikksiiefgsdf-cyou", "colour": "#909DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530570, "uuid": "eaed06c3-a3b9-4bbf-9ec4-458dcefd1955", "comment": "Malware payload (Smoke Loader)", "value": "70ebee8b57e3d51cc447739b62ef18ab09075df4dcd677dee9906ac68d11fa7436f0954c1fd292ddd12f5f79dc9aa93e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "sokdikksiiefgsdf-cyou", "colour": "#909DC9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530570, "uuid": "fddd50ac-95f7-4e20-975b-d839550872dc", "value": "T113549D91BA80C473E5670E3048E5CFB26977BCA55A606587E794BB1E1E333E38935307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530570, "uuid": "e020b044-653f-499d-b3b5-1f770000928c", "value": "8aa3ca6803a348717bc5413ccdc97af8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530570, "uuid": "8cfb27cc-971f-4416-b946-9f06216ce979", "value": "3072:G3y2NmX6hz21szDjZIb2jzYQUMpVKDsxkgaBChNZ8fg8/0E:GCAz2oDjZqwzQoigaQg//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645530570, "uuid": "05c50ea6-170d-42c8-a981-7e2681c300f2", "value": 286688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645530570, "uuid": "6e740ad1-873f-4c1e-acc9-d65d223569bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530570, "uuid": "e2707a5c-6a38-476f-9afc-f54b0639ff69", "value": "d93adfb94ccbcc7b2bbd5fee9039d93107c113e48b5980508682111dffcd0316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18393073-93fa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645546289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546289, "uuid": "6d9b5b30-5f94-4c06-9695-0b3e04ca10f0", "comment": "Malware payload", "value": "36263e4d58c6fe1d3d344b4b9b17bb04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546289, "uuid": "8b4a5b40-9656-4740-be5b-86e8e8a15bff", "comment": "Malware payload", "value": "d94e491d1b53fb257442927b2c5ec94d2bf62c37856a7bfc56d7b60da5f1831f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546289, "uuid": "ae84c2ba-28b3-4ac6-8a5f-5c3a68490b99", "comment": "Malware payload", "value": "a627bf34e04c54628a6ff4228d61bf6d98378ef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546289, "uuid": "6fefcd4d-6f74-4be0-aa6d-c9d74063a28d", "comment": "Malware payload", "value": "8171c426e0c3baa3348f4c4a5d0425a5b96170722d4912feaf29a245d14c7d33d08e8bedbd08162eabec2ff580da5924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546289, "uuid": "2638e5b0-7be1-4f98-9f4a-e5f64d7def61", "value": "T1A003E71A7892961DC5D47BF869B1A19366367CE10124C18FECFDBF29A933223DCC216D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546289, "uuid": "a1be9012-4a66-45f6-86f8-68ff1a01e5ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546289, "uuid": "57052424-68ff-4799-ac0a-ddf57c9a81e9", "value": "384:RNudRbMn4DfehMiQ6ulaiJMwCKTH2S3dd0hUADka9Y:RNudRbJf+Rml7MwCKt3deVDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546289, "uuid": "f8f67a53-dffa-436c-be3d-43e7edeff41e", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546289, "uuid": "3db1e8a9-1661-4847-9a55-03e4744f1657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546289, "uuid": "317d2856-79cb-4982-b292-744f690b442f", "value": "SKM_C3350191107102300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5193a06-940b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645553881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553881, "uuid": "71b4a14a-1240-4b07-bc02-fcf05d87ad8e", "comment": "Malware payload", "value": "636b1598b7b95d631a459077ac7891f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553881, "uuid": "61fbd3c5-4c37-4ea9-ae3c-deb382fbf288", "comment": "Malware payload", "value": "d98647d6980c737e5f0dc68464f26ed907c17b6b51e6fa1a2dc54fc5b249ee01", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553881, "uuid": "2d7b438e-9ebe-482f-b326-01845aa6b47e", "comment": "Malware payload", "value": "a72e40252f6d86e81f3c684dce26f435913b3f93", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553881, "uuid": "bddfc7fe-fd7a-4c76-9b68-ef032a69ad5c", "comment": "Malware payload", "value": "5312e6835f1f5f6a812341d04104f8ef43a091cce8786f704cb0827e40b480138ecb8dc880b135cd292cdd8706ca4bff", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553881, "uuid": "38789ec7-c1e0-4fe4-8fe8-37c2518371c6", "value": "T1F3930769B681C95BCA5807344CD7CBF67227BC424E7987873258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553881, "uuid": "bc07a6c3-86ca-4118-bfb5-0a61009b21aa", "value": "1536:5yehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQsWkWvgrPE4nWHPNc2Al:5yehv7q2Pjx45uoDGTj+5xtekEvi8/dK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553881, "uuid": "c0a8c97e-acb1-413b-a000-f03c6c280a0e", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553881, "uuid": "cb9e96e9-6f6a-43a2-be69-9253e34af783", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553881, "uuid": "91cee25e-157f-4e87-86c6-cdfa078198b0", "value": "tmp07ohlq91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b1300e-9407-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645552083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552083, "uuid": "1535fcb4-8743-4505-a613-bbf512f836ff", "comment": "Malware payload", "value": "e5b2b8d83f121c381703e07ae0b5e9d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552083, "uuid": "ee28dbc0-c88c-48ad-8afa-dde30b18f87f", "comment": "Malware payload", "value": "da89fa40bedbf30fbe4f124df13067401253bb736f4101b25968cd8114049f51", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552083, "uuid": "484d89fa-34ef-4b0f-bc6c-48184eea2453", "comment": "Malware payload", "value": "4e3ff8140c2546d306e6f1c49b010d8701ce06e2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552083, "uuid": "11f11494-ce22-4c51-a855-479438119447", "comment": "Malware payload", "value": "b336d0d25a83d59a2269c1d266d53e42189643c809c35cfca83dea268d769458a627708e22882eb5ef9a77a8cfa94bcc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552083, "uuid": "80fe6f0b-de1e-41d8-b8ca-ee3988d08749", "value": "T19A93F769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552083, "uuid": "1b17cbc2-1953-4429-beb9-d271a151c024", "value": "1536:+yehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQARkWvgrPE4nWHPNc2AB:+yehv7q2Pjx45uoDGTj+5xtekEvi8/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552083, "uuid": "41b368ab-279e-4d36-930f-ab8ac64ab03e", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552083, "uuid": "b51528f9-b3b9-4d73-a8e3-cbc0b28a90a0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552083, "uuid": "91630bcf-d93a-4095-ac21-664a78e9677e", "value": "tmpo23e5z3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b968877a-9407-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552143, "uuid": "dab12231-a627-4096-b28a-6423193b5232", "comment": "Malware payload (Heodo)", "value": "62be2a7cfc96ab376a329038b0c1b833", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552143, "uuid": "0baf77a7-c97b-4067-9219-8eb583999938", "comment": "Malware payload (Heodo)", "value": "dad414088e6ae1abfd70f302a8b4a557aeda3808c5d4ac36614309d93aa180be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552143, "uuid": "01ae951b-12f8-4d3f-a29a-2bf8c3124bd7", "comment": "Malware payload (Heodo)", "value": "8f3d43bcfa017089ce1e4b3351991f51aa10b20b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552143, "uuid": "f811fc6d-01e0-4075-8615-33e47c7da9c2", "comment": "Malware payload (Heodo)", "value": "e04222d69d965ed8b5062f7ef4e558da553912947f8c6671fe2ceea7197839175fd8efb615e27d2056617ba1c8df5946", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552143, "uuid": "938daaf8-1740-4ee2-a6e8-7a6d918e0bbe", "value": "T15BA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552143, "uuid": "467bf18d-2692-40ee-acc6-3e27cc12637f", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552143, "uuid": "d9cd3a8e-b38e-48c3-9295-5156a44e45b5", "value": "12288:vicw4w2Vb0zq6k5Z2mTGjqkGXNrGHORQuBT:viSwub0W6LmTywNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552143, "uuid": "4a3ee620-6c65-421e-8add-c61e887038f6", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552143, "uuid": "a7b81ce8-0b12-47ff-883d-d00db9f2755b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552143, "uuid": "a71d39f5-37af-4d0a-b93d-023b1d7db4f2", "value": "FrIQHl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6f03c0-93be-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645520639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520639, "uuid": "7c100208-3f31-4f88-bf0a-7ece0983fea1", "comment": "Malware payload (Formbook)", "value": "cc2746e502e99eb5216e158477a66db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520639, "uuid": "bbb50c27-ebb9-42da-b162-8696827afaea", "comment": "Malware payload (Formbook)", "value": "db791b3ac13d1bd18a2fb7925487e736cea8b932f9f3396e8758502331bb9162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520639, "uuid": "cd3f77b0-a518-463a-944d-01145a7eb608", "comment": "Malware payload (Formbook)", "value": "4988e9a780d56812892a0dbbe3594b5e51f72ed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645520639, "uuid": "1a789051-bcef-44ce-ae3d-c51cf70fad2f", "comment": "Malware payload (Formbook)", "value": "ccf10ade01f82e8a4052f3c1bc8c4dec3527e1e02b09ac827c953ee665fa451b542e8bf9190103b74607f27c148e604c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520639, "uuid": "d2918cb6-2a98-4e34-859c-6339bf972785", "value": "T1276412C1F1818852F95B1A31663BEF24C9B2EF262A55114793D4BF7B0B33343A50A5E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520639, "uuid": "8289aad4-274c-4cae-81fc-985cc69f5652", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520639, "uuid": "f2d5fd8b-7b91-469b-b8cd-66893f35613c", "value": "6144:/xDhU76BJzteLVBIQf6Tw9axmFUriacfLHFmbTFg9eOuQU:3U74eLVBSTsa5WacjHsbTFyeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645520639, "uuid": "e2339351-e9af-4528-a9bf-ed93a74d3a95", "value": 308732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645520639, "uuid": "54ac3490-07d6-4046-8a54-6dc5f2fa536d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645520639, "uuid": "dfd722c9-2542-4249-8510-23ef810ea149", "value": "REQUEST INFO SHEET MOULD & drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66685e32-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555011, "uuid": "14345a37-261d-4ffb-afdc-1912b4dac189", "comment": "Malware payload", "value": "c06322f22b9197d3f19cd6e6b9e3cede", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555011, "uuid": "ac442ffc-967e-4f91-9ab4-16be63f65a4d", "comment": "Malware payload", "value": "dbfc590266f2053254ef944086232ee70a0652266260e08d45e1c1b128370b2f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555011, "uuid": "bce74a21-d4f8-4796-9b04-3acea2835d1b", "comment": "Malware payload", "value": "71b3a833dd79b60e5f245918b3d933ec25d30bf0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555011, "uuid": "9b28a70a-25a6-4663-9910-b767cb70a88b", "comment": "Malware payload", "value": "27b304b0845987712c0f859b4740ebcdcd8818b22e44b98bbbab09ef1944cfb130433b944d4c3ce650d1c91a9d293ae9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555011, "uuid": "8737a469-3068-4b74-8951-85692fb052ac", "value": "T1A1930769B681C95BCA5807344CD7CBF67227BC424E7987473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555011, "uuid": "9e542d67-2477-4093-8ba9-d63267df6752", "value": "1536:dyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQA4kWvgrPE4nWHPNc2Ap:dyehv7q2Pjx45uoDGTj+5xtekEvi8/d0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555011, "uuid": "ed205118-20b8-4db4-9622-8abb59151543", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555011, "uuid": "b73d16d6-8733-46b5-81d7-eed3ca6e4f77", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555011, "uuid": "26a2810a-5d88-4823-90cb-8cc2118dcc38", "value": "tmpzf28v4md", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb20cfb-942d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645568550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568550, "uuid": "53082343-6c84-4518-bcb9-7dc314a8fa69", "comment": "Malware payload (Heodo)", "value": "88b4d61544dd130b53f97d931ce8910d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568550, "uuid": "a7ff1465-7916-4d75-a857-9b342d2718a9", "comment": "Malware payload (Heodo)", "value": "dcdd60351659eb01c55bf55f442c7819d747e735a7236ad1f8fca41ba3f190ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568550, "uuid": "b261fdc0-4cca-4a5f-aec1-ece462e8f004", "comment": "Malware payload (Heodo)", "value": "f7e67d8c0fe289187a6b4a2df28299de2c0069f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568550, "uuid": "f38ace70-bede-47b2-8da7-07ce29b80381", "comment": "Malware payload (Heodo)", "value": "8fe124f5cab095fe2b07e26647a35240c6f13ff500d8fcc2822b369f0e4effe18bce21909e3ffae96c24604d2c15ca8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568550, "uuid": "f9441eb7-25d9-420f-8ee3-2017db852c65", "value": "T124B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568550, "uuid": "0cfc35d0-1d06-445d-8053-ded9ec5eb611", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568550, "uuid": "03265b1a-7f84-4344-a814-bdcea9b0d18e", "value": "12288:IOzyEtBX2ZHq79+G6/G5YgvmgZDa6A9TU:lnmZKR+GYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645568550, "uuid": "d8b22024-cfd9-4ace-8ac0-a9b965c8b3a2", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645568550, "uuid": "c057603a-6e62-4757-bd57-e49108371113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568550, "uuid": "55687522-59e2-4ee7-b080-f35ebc67eec8", "value": "88b4d61544dd130b53f97d931ce8910d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf277ab-93c3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645522729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522729, "uuid": "a9ede086-f115-4ed8-9976-30d7fc18575a", "comment": "Malware payload", "value": "1f38042a4264617e03489fe53ab7b6a1", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522729, "uuid": "9600d91c-221b-4b5e-bfd4-0c150478def7", "comment": "Malware payload", "value": "dd1f757b4a90e009c67110dc9e24660c830e61aa1f16a3679cd36055c8ba3a41", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522729, "uuid": "ca3d54f6-e91e-4d91-b17f-8f7417cd50c8", "comment": "Malware payload", "value": "8bcffa1488ae876beac74581668d42555e125655", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645522729, "uuid": "de03868b-06c4-4554-b77a-b77bd72eeada", "comment": "Malware payload", "value": "62022315ef8c22859a426adbceda5f7906cd0ba13948705adc49607d0fbe9476c6aa28807212b5bc44de1e78a08f26f0", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522729, "uuid": "a98ec178-98e0-49ff-a8b6-8cef65a9464c", "value": "T1A041D6A6D76A8007D0613AB738A9F560242A562E9D09708227EBE48079B11FC6ED6C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522729, "uuid": "c7e52043-20fb-4398-ad68-275992a57832", "value": "48:9LoEF++vn7lANcbtPcpRv3Vf+HVixz1REjXYDfTiC:Wi7YwtEpRtf+ORRDD7iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645522729, "uuid": "4da767a7-1e0f-4d2e-9177-e8e1d7115411", "value": 1983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645522729, "uuid": "e803a35f-8f09-4b78-bcf4-da08217b5704", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645522729, "uuid": "c252618d-2714-4623-8a0c-53da8f18ee4c", "value": "documentaz_819.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df06133-9413-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645557090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557090, "uuid": "4d86305b-6a0f-4d05-9bdc-4f775daadd03", "comment": "Malware payload (AgentTesla)", "value": "b8d8e0ea62be357ef4e8d877f5b8790a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557090, "uuid": "5fa431b9-608f-4a9d-820b-968bd79ef061", "comment": "Malware payload (AgentTesla)", "value": "dd30a46945847d09470fca6080d1561a3aaeffb697eefbbdcdfb50c06e6f9bb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557090, "uuid": "c0d93594-d06a-4486-98ad-7e5bde5c89dc", "comment": "Malware payload (AgentTesla)", "value": "a3605c8b716b6441f7d22c2ac40a70e39717c912", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645557090, "uuid": "28d4dd6d-40c6-440c-b0b0-86a3953ba4e6", "comment": "Malware payload (AgentTesla)", "value": "f39fd93870926b80984c8e1b4c1e21efccd6ad90df273c4ec8ae8ca7c46f651a6afeb684edbcfccf3d3292bddfe0f9c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557090, "uuid": "b076d3d2-29e7-422d-af5c-837b263de895", "value": "T1F5D46B6121E6CBB6E5FC93B8F42280F61FF47D19D611E12B3CA13EC975B2E406663612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557090, "uuid": "e44033cb-0139-4324-96cb-dde33e7a1e7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557090, "uuid": "069dff76-a66c-4f9d-8f9f-a7d352c6ad82", "value": "12288:P0FJJZO6qH1h+4VHSpxIkf62Yii5KvzpAz5fJu9J5DMOM704Tv+ER+msm4c+WrHI:o8Q4rqO4DOddO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645557090, "uuid": "6bd3406e-4cae-4cfd-9561-0cd1b4524018", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645557090, "uuid": "2d93dd4e-6a95-45a0-85f8-ce0aece42edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645557090, "uuid": "67a2f8ce-06ff-4794-85a3-7089bfc9e681", "value": "GEF20220221-147.IDX_FTL_GROU_POOO8.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80a948b-942d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645568542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568542, "uuid": "7f0b5d3f-5b6b-46a9-989b-08898c4a3821", "comment": "Malware payload (Heodo)", "value": "7b54d922d3a628348a777bc8371ad7e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568542, "uuid": "15df7199-6ade-4b65-97ab-788cd5b7e5ec", "comment": "Malware payload (Heodo)", "value": "dd37f02d072985adb0e33e9be9d5720c3d687fffead4d68b8e0aa4b869fb3029", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568542, "uuid": "7ca98310-857b-4798-844d-634ee3d6848f", "comment": "Malware payload (Heodo)", "value": "7a8e83967229b8287d9b71d4998305e350b64f48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568542, "uuid": "2b1919f4-24ef-451a-9021-f16b907332a0", "comment": "Malware payload (Heodo)", "value": "bd8c127dd695cf8a879470b81c5dd7682b96eab355b0b07a21200ac1b3ef12c0e8191f935332a10edd7701cf6c5dee48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568542, "uuid": "b5f98aa1-a148-460a-a611-231bff0892f1", "value": "T1B7B45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568542, "uuid": "6fbeda7d-c4f8-434b-99f0-d30314587ca8", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568542, "uuid": "05e5dfef-63aa-4e54-b6c4-6d045f947f34", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wbIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzW8zo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645568542, "uuid": "629445fa-56d2-4ea6-ba6c-c54604ac2317", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645568542, "uuid": "3f7d4d3b-d6b6-41cc-a059-bfb8140f7e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568542, "uuid": "27fc6d79-23db-403b-b3d2-6e0f5bafe8df", "value": "7b54d922d3a628348a777bc8371ad7e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23de9693-9373-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488327, "uuid": "df4de137-5a42-42d1-9267-18111fa29dd1", "comment": "Malware payload (Mirai)", "value": "5916c8176e73ec8f5dc36eb58c09ff6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488327, "uuid": "f1bb1437-b7a6-4b79-87dc-3298c1c4193d", "comment": "Malware payload (Mirai)", "value": "dd3c89260d5edd45f6fe2b8a8ca297901752da9ead3df31129e58921b0164e97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488327, "uuid": "6d749b97-1675-4c40-bb89-33b7aa7f5b5a", "comment": "Malware payload (Mirai)", "value": "787c6a2447dcf09ee07f73b047380b05a3d8a273", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488327, "uuid": "8fdb77ea-36f0-471a-8287-84ae9071cba3", "comment": "Malware payload (Mirai)", "value": "4db28c709a7d0ed50e7b511e71a8fb9956abbba937921b9cafe2517ae13281601379f08d1c600b9555d529840e1170ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488327, "uuid": "c99d5365-3fdc-49c0-a025-057ce895888c", "value": "T1EB03E1B2BA44D2E2FA759836E8198E067732793900E4541D727D8AE17DB3489B7FD8C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488327, "uuid": "a1f34796-c44a-480a-bc58-cff3f708f51c", "value": "768:cDmFsD101rfDkUcq8RxHcLCABNAQ3OX/y/pQBUq3UI3U:odR01rfDrcmLCCeLGEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488327, "uuid": "2d1da34e-41f4-4436-8211-a8a922d4da71", "value": 38224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488327, "uuid": "9fd1108f-e745-43f8-8480-732a8076c7bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488327, "uuid": "56547af4-ccf8-4c5e-b699-eba778a6150b", "value": "5916c8176e73ec8f5dc36eb58c09ff6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01a139f-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645528049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528049, "uuid": "3a3e46f8-885c-43d7-bdd1-13354ea72aca", "comment": "Malware payload (RedLineStealer)", "value": "79b4296ef801845fbf5406235bd9d310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528049, "uuid": "fc70f9b0-3d6c-43bd-a337-a4e6b0c5ff80", "comment": "Malware payload (RedLineStealer)", "value": "dd469d067ee8f95f77fa9de6ae88c95e3a3d1b35c908c04eeba82a46316d1990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528049, "uuid": "5369ee8d-4994-4e6c-8d96-59eed666ffd0", "comment": "Malware payload (RedLineStealer)", "value": "aa4960ac7785ab8ca1f270ca9b559c23d4bcbbdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528049, "uuid": "3ace52d8-086e-425d-8173-ee3456e1cabb", "comment": "Malware payload (RedLineStealer)", "value": "ec89da7f0ba04828f27f465de346e8d33ee72488d99e7868bec7411a0c3db8fa2a20314424a305b91552bf23a77daf7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528049, "uuid": "77630e6b-c488-4177-aae4-beb8210186cb", "value": "T1EA3633B04B88CF2CC59D313C6DE2AA59BEB5949955328001EC6DBF930FD4DB7AD0A039", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528049, "uuid": "7353ef25-c93c-4c68-b673-5b4c8107753f", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528049, "uuid": "bf674798-593c-455a-ade2-424fcdef7162", "value": "98304:/bMCu7g45bSx1A7ogb5AvPQh5Ica04S869ijTJpplb6awxNpTJD:YFdlJby3i5IcP8pppxmxNpTJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528049, "uuid": "2c557101-39ed-44ed-a136-83207f390f68", "value": 5158192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528049, "uuid": "23e30535-411a-44d3-9097-f2da623a43da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528049, "uuid": "edf9d7a2-f6b3-4695-b23c-51d8b1c03b26", "value": "ADOBE PREMIERE PRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4157d4c-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514741, "uuid": "67d28658-26ec-4b4f-be37-902bdade59e3", "comment": "Malware payload (Formbook)", "value": "3fb54274b9704bdf073ca2a2ef6fffea", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514741, "uuid": "5d9bcbde-1322-43e1-9d31-9aa98c8ba980", "comment": "Malware payload (Formbook)", "value": "dd4ef87d3ee1f79c6c650bcb11f24ccb3f90bb98c839d4725c5b081c9e87ca31", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514741, "uuid": "b8fbabc3-8bd7-4ea0-a5aa-97e1485a66c7", "comment": "Malware payload (Formbook)", "value": "9c70d93059c7d7afc60eeb116dc95d63c1f00c31", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514741, "uuid": "7230c981-148c-4d9e-ab4d-fca1194a7abd", "comment": "Malware payload (Formbook)", "value": "2c0e63582fc1cf43d6d082cffb73dc46c750e0080366439eba9254809918e9f473f16aef270791a36abba0fda3b0bd52", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514741, "uuid": "660b9418-51e6-40fe-87c0-49cc60ce3cf5", "value": "T12CA42382E463C7E9C86C79F1D6DB2CDC3469388BC51C57652E8D6DC601C67EBB18E809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514741, "uuid": "59d91fae-e4fc-4369-a9d8-1a81714f780d", "value": "12288:OXFYqqVkeNb9YxHHjwuN46ZAT7PIGTq2ZQiUmD+:MYqAnZ9UnjwuNJZAPXjOmD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514741, "uuid": "20e7f5cd-1982-440c-a155-c5b529d4e9d5", "value": 489029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514741, "uuid": "1a8fe7f6-591d-452d-9c88-57513ac26808", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514741, "uuid": "ce838639-5263-4365-b13e-c361345aa343", "value": "Shipment Document BL,INV and packing list.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ed808d-940a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645553498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553498, "uuid": "85433f82-8b28-41de-9171-5afa4d42eaf8", "comment": "Malware payload", "value": "b044c3cbb2a210cf3dc9373b77a2f02c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553498, "uuid": "61db711b-50e4-4346-8e05-bf2a5e2b52ee", "comment": "Malware payload", "value": "dd9d622b937a353269b4718a5a62dfa3d949a01e843c250343142e0c2086009e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553498, "uuid": "2088bd03-d5a7-42be-a8fd-f11880814fd0", "comment": "Malware payload", "value": "1c5b47d322f880f7db28c5c36cc7b0153d65f6b2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645553498, "uuid": "d5132366-15d2-4766-bbe0-8abf32e0aa30", "comment": "Malware payload", "value": "56ac7ced8d54b49548262784108fabf09e5956a35572efd7a15b2c10482300c7c95369029287146b9bf450aad032e649", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553498, "uuid": "3e728ff7-07b6-4611-b12b-4ac4d8b0652d", "value": "T164930769B681C95BCA5807344CD7CBF67227BC424E7A87473258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553498, "uuid": "653dc936-c3cd-4ce8-8cd9-aa8b522f8c42", "value": "1536:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQsBkWvgrPE4nWHPNc2Ad:Pyehv7q2Pjx45uoDGTj+5xtekEvi8/dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645553498, "uuid": "fdcbc618-d02f-4f43-b223-13146d2f5135", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645553498, "uuid": "031ca643-f3c7-4594-89c2-559c15e73a75", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645553498, "uuid": "d26a6881-9f38-4d57-ad42-9a78b59125ef", "value": "tmp458j_tch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ff713c-940c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554225, "uuid": "0885e490-d332-4d97-a085-c9e23e62c951", "comment": "Malware payload", "value": "3aaf9a9923d08e18fad6891c6d74b9c6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554225, "uuid": "b148bf95-0525-4d86-8fad-3a357bb725a6", "comment": "Malware payload", "value": "ddabae60fddc1b263d63c08925f366a08a769a5387cd98d8994e77e978a9a802", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554225, "uuid": "8848ee9c-bc89-47cb-87dc-fd7abccd5b3b", "comment": "Malware payload", "value": "5f99735f8d28a761248c21e31b5257b09445a744", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554225, "uuid": "70f0fd87-6e0f-48c6-8169-f7d25af2ae34", "comment": "Malware payload", "value": "cb35f503e1cd0814a835633619d451a0fb7157f8ce8599e9cb883768de0fc3b90950b9e5634978c302f3137c01224e20", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554225, "uuid": "51387be3-62f0-4a1f-8d2c-9bb2ef6c9432", "value": "T15A930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554225, "uuid": "757a6277-6b45-4c7e-b886-1bbc2e04a71d", "value": "1536:Ryehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGpkWvgrPE4nWHPNc2AF:Ryehv7q2Pjx45uoDGTj+5xtekEvi8/dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554225, "uuid": "23d96b49-a629-48ba-98d5-39e7be77fae5", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554225, "uuid": "1e390a99-ac7c-4530-9b1a-d5eefd8096b7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554225, "uuid": "8e5f7d0c-3ead-4bb8-863f-487e56b26e5d", "value": "tmpeiqwu0eg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9aebd2-943a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645574082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574082, "uuid": "a86de12c-f3c4-4691-b9e2-e4dc40997a32", "comment": "Malware payload (Mirai)", "value": "07f5923d675827efc041754e7aa13e8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574082, "uuid": "373a7e2a-1b2a-4ffb-a975-c7a6dae99cb6", "comment": "Malware payload (Mirai)", "value": "ddbc5f843ee11ba435934295c3634436abb820b7119f9e4e10d18f78b9e85ee8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574082, "uuid": "3e1142b2-b8bd-4838-9499-6491f2b7f31b", "comment": "Malware payload (Mirai)", "value": "f8c56b56612d037e7aa784b807d540f151183d8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574082, "uuid": "02d495c7-c781-4991-8714-abd8cc3dc01a", "comment": "Malware payload (Mirai)", "value": "9fa3801d1d6ece732b8dab15b1da0af54f2cc37c5ce48a4e27553ac7e0028bf6c6af8c0b4486f24a908616f2023da819", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574082, "uuid": "0be9251c-a5b6-4ca1-9c07-20901da3cc38", "value": "T1CBD2E03D470150E7FE51C1BB16C427D22CF14FBEA953E80A6A13E1A3704A5A7BA87DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574082, "uuid": "39674929-2ec3-4a8d-8d09-04b0a636a448", "value": "768:FSV0DoD7fqkM0Cm8whkepm9IcSJgGlzDpUYsd:000Dzy7um4VqYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574082, "uuid": "859c6f14-f1f4-47bb-a321-02327c39a783", "value": 29244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574082, "uuid": "a6fabdb2-c59d-4d5a-b33f-d06a3c202501", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574082, "uuid": "1d8c57cb-d294-42ad-affd-c24fbf92cabe", "value": "07f5923d675827efc041754e7aa13e8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a49d511-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564922, "uuid": "cef42fb8-a9df-4f4f-8432-3c7b745e1e15", "comment": "Malware payload (Heodo)", "value": "87a061447d883943f3ea7560f4b493fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564922, "uuid": "51373305-4e98-441c-a613-00c81ca8e055", "comment": "Malware payload (Heodo)", "value": "de5b18fd7b378c23c7d0aac05fae99016df0b44f853216cba30a9f4830e0b00b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564922, "uuid": "f8cd482d-47b4-487d-952c-8059d7e5e2ae", "comment": "Malware payload (Heodo)", "value": "3f6d80810119f00731c1799dfbd8061271c14ac0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564922, "uuid": "8bd769c8-7a80-44ed-b4cd-6758629acd5c", "comment": "Malware payload (Heodo)", "value": "3eaf6954ca6685ccd43cba2fa440e3d9635888676fc06e7f856d5c645553992015d348b1e573687b00a943de086392c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564922, "uuid": "70b7846d-9249-4dc7-9325-70a4de26de21", "value": "T10EA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564922, "uuid": "802def45-536e-49a4-8ddd-74af1de4c487", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564922, "uuid": "4cf14e6f-d9f0-44da-91da-9e88f8682ef5", "value": "12288:vicw4w2Vb0zq6k5Z2mT0jqkGXNrGHORQuBT:viSwub0W6LmTEwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564922, "uuid": "2df90a8d-1e34-4215-ac14-02bc8efe097b", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564922, "uuid": "d5b104d5-f5a8-4670-9a72-9fc4ab88bcf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564922, "uuid": "6fe6d5e9-af0f-4e9c-b2c3-2d791337d616", "value": "3hA9cU2BfJaonNykyreyn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1f1146-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "caa919f4-52d8-497e-943e-99b1b4a87968", "comment": "Malware payload (Heodo)", "value": "2d741661f92919de1e09666cd9122dd2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "7735ab15-3caf-41e7-acf8-7da835567e9f", "comment": "Malware payload (Heodo)", "value": "de8d082872a567696abc942b6b65efbb181c7a75be64607f837cdda7216f3b11", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "3b8da9fe-4814-4a90-9069-31fb1838bfcd", "comment": "Malware payload (Heodo)", "value": "53a368c2e89ce4e767b46344d0cbaa4d85edc108", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549943, "uuid": "e9c18853-4314-430e-9218-587cedebd7b4", "comment": "Malware payload (Heodo)", "value": "b2dce15239066769fc5c73245f9a4c9e98e37e7c5daf4f125f9235e0e2229bc228d8cdfbeec87cc2799c7a970c54f913", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "d05c0b2b-6834-45ef-aff3-393c29907c9d", "value": "T1BFA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "ebabd637-c3f7-4e66-a3d1-627158a43464", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "1b174f12-cbeb-43f5-a499-b37821bcb519", "value": "12288:vicw4w2Vb0zq6k5Z2mTFjqkGXNrGHORQuBT:viSwub0W6LmTTwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549943, "uuid": "bd01c305-c20b-4326-8590-5a1e0e2ff88e", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549943, "uuid": "45bed75c-000d-4300-8a18-a5132a5ff26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549943, "uuid": "b597952b-d21e-413a-8de2-b7d58f728422", "value": "emotet_exe_e4_de8d082872a567696abc942b6b65efbb181c7a75be64607f837cdda7216f3b11_2022-02-22__171218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3bc38c-9402-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645549945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549945, "uuid": "4bb65a83-5eb7-41ff-bbb8-c63ea5edcce4", "comment": "Malware payload (Heodo)", "value": "22ca215439989f8e9b3b0ca48cd21f16", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549945, "uuid": "5014496f-42dc-4b2b-9155-e77f37ca06e9", "comment": "Malware payload (Heodo)", "value": "de98e6feb97a7ccc913125f56962ad06b646d1542dd5620051bbd63f46fd6881", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549945, "uuid": "1451f029-761b-4bed-a32e-d1b1e7d0056f", "comment": "Malware payload (Heodo)", "value": "b65b394b7b6909d307752e77e1035cca2719c83d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549945, "uuid": "5b834fde-c25f-4fb4-be0e-1c1c4c7fca2f", "comment": "Malware payload (Heodo)", "value": "0b18842547d299b28dc58c252bbb7e8f6705a02be3267b20c9d92523b09381eb2d0c4644a02dd5d91db39afa8c817897", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549945, "uuid": "56c5477b-80cd-427a-8041-ff1a477d5a72", "value": "T1DDA4AE21B6D0D432C26E30747A16E2B15AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549945, "uuid": "758437c4-4f47-4ee0-8f9f-514cde3f9ced", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549945, "uuid": "d49a2602-164d-42cc-b560-dc5b8ce17577", "value": "12288:vicw4w2Vb0zq6k5Z2mTZjqkGXNrGHORQuBT:viSwub0W6LmT/wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549945, "uuid": "e7cf1f0f-db79-42ca-899c-4281e390c112", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549945, "uuid": "43e2a25c-6089-483c-b41c-2f1f861a9198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549945, "uuid": "f9b3495f-09f9-4a7e-8bc7-1c592b096502", "value": "emotet_exe_e4_de98e6feb97a7ccc913125f56962ad06b646d1542dd5620051bbd63f46fd6881_2022-02-22__171219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45f95ab-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645518285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518285, "uuid": "72a7ce44-215c-41a4-867f-3ce8588734d9", "comment": "Malware payload (njrat)", "value": "4b4e6ce587df768d5f3530aa8c2a3a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518285, "uuid": "d9c86f43-f98f-49d7-95d2-86f2d168e06f", "comment": "Malware payload (njrat)", "value": "dece4adf99e29edff4ef336fe6f7c40ffb90abd46514985ef86ef7c4fe5e94ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518285, "uuid": "4189100f-3391-4366-8a79-c4eaa5c1d2d2", "comment": "Malware payload (njrat)", "value": "87169151f1c6b437966e5c54a683b3675d41af95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518285, "uuid": "58348d1d-e265-437b-a1ef-a9e9c45fa60d", "comment": "Malware payload (njrat)", "value": "142057d17b5cf417ace54b4796d34c4b3ffc7a4e9a32db9388ffda33fb51f0dd119e37f32904f0d75fcba76f368601a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518285, "uuid": "a47178de-309f-4d48-926b-29e58196e043", "value": "T11364FA4976E0420BE27CCA7609B6DC19537AED97262FD64E4EFAF0F62F3F5800501A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518285, "uuid": "13c83449-64ba-4ad8-a44c-29b80d3356d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518285, "uuid": "2c6f0ad3-33c5-4ada-bcb7-58001a11fb5a", "value": "1536:KJdsLi7tBnI6eLK1hyuBaIeigUr2f1KVF9PlR:KJdsLi7tBnIf21hyOt46F9dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518285, "uuid": "efb5dbc1-820f-4434-8d01-04cf3bc997e0", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518285, "uuid": "648bf880-f98a-4c13-a7e4-d184342506f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518285, "uuid": "539ac847-7236-4c04-bc77-ccd78e090a01", "value": "4b4e6ce587df768d5f3530aa8c2a3a75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8df0c42-9433-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645571121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645571121, "uuid": "f8e29ea5-3b46-4f6a-9b07-222946fd695c", "comment": "Malware payload (AgentTesla)", "value": "4c33263a8f1e4cd5bb7deac18328ba0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645571121, "uuid": "94676caf-3296-4e0d-bf6a-b324d64fade4", "comment": "Malware payload (AgentTesla)", "value": "deeb0bf270ddc5c8a8e5d2f898d71de9d71009f9e7e74747ecfc3c399e85baaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645571121, "uuid": "428dac69-f6e5-4057-a05d-d132136a4b4e", "comment": "Malware payload (AgentTesla)", "value": "9a2e6f93eba644d0b33c902663bc30ed17cecfd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645571121, "uuid": "8e58e089-d1f4-4af7-b941-5dd3215a8029", "comment": "Malware payload (AgentTesla)", "value": "d30404c3fa87e4d5a3ef47af651be93dde5b7e7bdabce10704b7c4916e8a239d52c175986e0737c397e5cdaf8420cc8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645571121, "uuid": "2d41e8df-cac8-4d5e-aeb8-9bef49d5df43", "value": "T1AE15CF142AAB0F3DF1B94BB248C1EC65F7A9F7236C45F37D78406696CA52B408D422B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645571121, "uuid": "2097b1c8-0f86-49fb-baaf-8c00f2314d47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645571121, "uuid": "acc2fb19-167b-47c1-9a93-0f3462c69a13", "value": "24576:XENi7CP7PXzl/FmPRPG4/Pw4wYaBjKMP3L6agNfF:Y7vzltIR+4BwYaUMP3L6a6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645571121, "uuid": "03e7d630-67a8-437f-9ddc-4d796bc5c4b6", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645571121, "uuid": "2d51c79e-f965-483b-9e6b-f562e5a05937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645571121, "uuid": "244aee58-bff1-4f6a-b286-1d207cc5da8c", "value": "Company Profile and PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112ec0c9-938d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645499462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645499462, "uuid": "a0577238-e8a8-4c5a-923f-88f20a1dc52b", "comment": "Malware payload (Loki)", "value": "a92583de8cc0387bf6631b2a6790fd01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645499462, "uuid": "d8becc0a-ccd0-41ba-a87c-daef7326aa53", "comment": "Malware payload (Loki)", "value": "df749f2d718e78d00b5dbffb57a386ff33f5909c032f52c7cfaf6ca135034b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645499462, "uuid": "49867335-0e1c-4834-9388-3b4c83c98a86", "comment": "Malware payload (Loki)", "value": "eec4306840e05a4d337da1dcafdb0ca3903be2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645499462, "uuid": "6231c105-197d-401d-9840-51535d001172", "comment": "Malware payload (Loki)", "value": "62ad3490d8883d5f564e4b305be621a539dced691e4746b4a42bcf87083208b879095ae67647b03ac50bf462fd13fbc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645499462, "uuid": "8066a86c-5c80-44c2-a033-d6b54bb7c938", "value": "T10D341292B0C8B017E0975B755636C23DF6FBAA041A70620F57DA4F7E39321C7991AB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645499462, "uuid": "2b7166bb-861e-4181-a001-c7b8a30700d3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645499462, "uuid": "ba036b3f-a51b-41b7-a707-a835c56a5fb9", "value": "6144:TxDTgUCxQYh7oE8ksxb8AYpylG8Vo9NooKnKoKn:F2n70pYpQmNqKoKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645499462, "uuid": "df80f3eb-b868-42c3-b556-5738f2b1f154", "value": 236448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645499462, "uuid": "b2b61e6f-cf1f-4d4a-a194-a15b201a5f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645499462, "uuid": "ef2d8d10-ae7d-45b9-81e1-45f1e6adab57", "value": "a92583de8cc0387bf6631b2a6790fd01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c371898e-93ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645513505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513505, "uuid": "5c328c8a-9b7d-453b-8754-f366db32e44c", "comment": "Malware payload (Loki)", "value": "9122344e3b9e4ed48c49bbe2c0e2c0ea", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513505, "uuid": "99ddb1df-2d11-49c4-bee4-636bbb1117fd", "comment": "Malware payload (Loki)", "value": "df7674f44ffc5c738cd3f1efa27aff8ec3d47f8dadd8cba71c13b9c81e683e89", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513505, "uuid": "a220bb29-2bd4-4a1b-8303-38b1c60d2c20", "comment": "Malware payload (Loki)", "value": "d9b085627de8413f0920d9230d10e61c77e18f9c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513505, "uuid": "f18783a1-5b29-4dee-9900-d4df414dc508", "comment": "Malware payload (Loki)", "value": "267cd11d9f77a0c6eabc8d744fa65839aca0c79929541b032a345b11ff9640f91fd9442e79155ff67f24ff98dc506e08", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513505, "uuid": "354107ba-b47f-4c78-9e7a-cb773d248207", "value": "T10AD423BCDDC1DDDB42CE371EB1CA0089DE1505922A2A3B866C71B54D6CB2875A0DE8DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513505, "uuid": "88d33dda-d0da-4f89-a07c-d41aae3f5089", "value": "12288:+nm4i43v8KY2xQkGY3/sQmh7rklvFs070x2yQguu9t3AB8AZom4:+3f8z2x8YP7mh7rk8dx2jgujBEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513505, "uuid": "675eda21-79ab-4366-8806-7532b317bc89", "value": 640275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513505, "uuid": "8be4aa71-b729-48a0-b11c-2add7416e3b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513505, "uuid": "e93178ce-03b9-4069-88ca-537b8a7c3478", "value": "193026588 Swift Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a4285c-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531791, "uuid": "277588a3-662b-4a54-9986-9cfabf421fbf", "comment": "Malware payload (Mirai)", "value": "69bf35ab03075c6a754bff9b84c9d97e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531791, "uuid": "b5bedb74-e62b-4eae-bd3f-a9e8c6876cfd", "comment": "Malware payload (Mirai)", "value": "df8289185decee941c47f8195dbf570a513cbc8ca6d5fbe6c08415b6dedd415f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531791, "uuid": "ce859bb5-16f5-4ff5-815f-1d4f59eb2b67", "comment": "Malware payload (Mirai)", "value": "fb13ba0f83bf1c31a47288fd907fc0d00e425b3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531791, "uuid": "f76e9e05-0176-42b0-8c57-241fdad05f57", "comment": "Malware payload (Mirai)", "value": "fb72e5f4e435313285b2b9287d1a929e08156c79f69fa5fb2e35125a56ba1ef7ec99e36766f056593c5efb8a01dd6568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531791, "uuid": "bab83807-dc17-4002-bd91-450c7bfd8aa8", "value": "T12C5339C1A983DCF2DD1146B83177FF328636F436212AE9E7D7D9A923AC81E41910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531791, "uuid": "7627d636-2100-4eb5-9ba6-47420974ab8a", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5BzfsYmrpY8+3UoBiAGpTLE:VMzVhePlkmetvBcxJhyu5BTyrpE1oAGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531791, "uuid": "4457ec9f-5ef6-4f0e-b07d-85203bd25c7a", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531791, "uuid": "ca366731-4808-44b2-9dfe-33946b98b2c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531791, "uuid": "573cd2ec-d5b5-40d7-85a8-15589e6518ee", "value": "vcimanagement.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c0a4c6-9400-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645549106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549106, "uuid": "ea03a18e-81d4-4c1c-bd6e-2d743c3735f4", "comment": "Malware payload", "value": "0faee3dfee432f821ceabeaa0f2d234c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549106, "uuid": "969d3ac6-8639-43fe-bb8c-054cafda242c", "comment": "Malware payload", "value": "e010ca233178440ae92c7e3bd045fd1d5724ee865748322c3125cd7dc6f96871", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549106, "uuid": "e36b4d3a-ff6b-41de-a9dc-df772ba0dbcb", "comment": "Malware payload", "value": "5e48dfe31fa25fd0fcf173cd42caa98c9a253394", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549106, "uuid": "c13b01fb-72e6-41f4-aaa1-b5fb306ac1d4", "comment": "Malware payload", "value": "71a377efe64f6842ff1abe4aa00e272ceefe8343b8bd142dd232cc7e7451de133997a60121319429b0877316a53d8ecf", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549106, "uuid": "fb6bc344-3315-4dc2-bbe3-7820a01a83bf", "value": "T1E195C9F530887C83E127D045710D7A8A2A11FA9E93C6B6C873BFE2B5715A543EB4C993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549106, "uuid": "592191a5-2433-4d49-9368-4146952fe963", "value": "6144:nlSlI2JkvqsLvDHJDXN4HKzocg/X1tpXX3T7ucEYAc6O7EOIzI2XOITEJg4COZE3:7zbxNI5Ta8cHRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549106, "uuid": "096ff50b-ec82-47e5-a812-1a1fcafe86ed", "value": 1982443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549106, "uuid": "fd539cc4-e0f3-4c17-acc4-59742b692dcc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549106, "uuid": "da053254-79a9-4fc1-bb24-7a919f2d7441", "value": "Airport secuirty.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b08f310-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518162, "uuid": "504f4311-b0dc-4043-9715-b353dff2dd09", "comment": "Malware payload", "value": "26ad853ffb77724f644c419434ec7ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518162, "uuid": "8d164d80-b6c8-46d8-b3cc-2954253347a7", "comment": "Malware payload", "value": "e08b30f356ced83dbc25d6a41d699a7a7eeebe63d803a3d0b340667cea8b606a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518162, "uuid": "82b5203f-374d-49c4-a5c3-2795cb6aabd9", "comment": "Malware payload", "value": "6e05f5bb4257aefde0d667f665eb81f9717ab452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518162, "uuid": "f9b2bd82-95a3-49bc-bf02-309c7f2c3950", "comment": "Malware payload", "value": "b19b614165f344eb272871565edcd2c3128d1febee21b24c7ebcec1944dd1daf260daf367695b4ed1a6dd015bda41ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518162, "uuid": "674cbac4-8e39-437c-8fc6-50ac1b10fa0d", "value": "T1CDF4AE53B9D184B2F1470972443A973B7E35A7006925CF87D7C0AD780AB6290EA3F7AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518162, "uuid": "7fbad45f-2590-49a2-aefe-89d76bf0703b", "value": "d803cf4cabab38ad6ac8123e3c7a53dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518162, "uuid": "0057ee95-8e54-443e-a37d-26d7d7a81ff1", "value": "12288:QEoJBugIbiOGk/zAAX0MBpaR9yR3dL6D04CcLrrRqQcD7RF5wwyUx/4prRxOLBYt:1oJBu2XV04jnHW8VwBYcOa3sM6zlYzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518162, "uuid": "c6d2a779-3ab2-496a-80c9-9ceab50984f2", "value": 784484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518162, "uuid": "26292adf-7dd5-49bd-b673-68d8d9ccff30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518162, "uuid": "4dba8b48-3625-431b-82fd-1a3ee0fb30f0", "value": "26ad853ffb77724f644c419434ec7ad7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b1c589-9418-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645559407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559407, "uuid": "cd34c630-ea80-479a-bc08-4e6e1c31f592", "comment": "Malware payload (Mirai)", "value": "b40b6715e3c8100a7dae18b5a3728717", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559407, "uuid": "7fbc6f4d-10b2-484e-a7bc-ae3f9c8592c1", "comment": "Malware payload (Mirai)", "value": "e1282642c24b10228cc0bc10e1ea9acd8cc9d6150b8beedadc5e37f8b0a5c33f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559407, "uuid": "cf7eaa20-b5b8-421d-966b-d5fc859c5b7c", "comment": "Malware payload (Mirai)", "value": "66b6fbaf1b184bf15184199079292cd3d0831fd8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559407, "uuid": "28f66253-27e4-4553-840e-5c6bad530cfd", "comment": "Malware payload (Mirai)", "value": "5a57e3540f53bc5c92d8945b50e165e957e67e9cd1c9795f81a64547238f358483502f0d62bb12dd0bab25c0cab6bdd7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559407, "uuid": "aca6067d-199e-425e-9a65-8a0cb48b9ac5", "value": "T180F2F262E86ACB12F12158321F0AC4C9BF1209F7F3DB78D52816E6295DCB40492F97E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559407, "uuid": "492a7362-7932-487c-bdef-c4661b415ea5", "value": "768:wWSXXabHd35ju1C9VllGyf/GuBJ3iAa8zKPls3Uoz+:wWSXXCF5Gcf/GuBtiGzkoz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559407, "uuid": "be166265-f313-40c0-bfdd-7231671adacf", "value": 34896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559407, "uuid": "10569c31-2ca2-402a-a2ab-4d0c9d1f4e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559407, "uuid": "8bb25c13-490f-4d3d-9d0f-3b871a6d25ee", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abb42c6-9373-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645488312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488312, "uuid": "1e4bbf8b-0346-4eb2-8a9d-77848eac93ab", "comment": "Malware payload (Mirai)", "value": "04ed52fcf8055d114396dbb924c03c26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488312, "uuid": "94a1be6c-4050-4644-a6a7-54a3c1e8cb46", "comment": "Malware payload (Mirai)", "value": "e129e64c8028bf8458aad062c4f80029af626362c55dc9b9c2d3bc27e968fc47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488312, "uuid": "7e842f05-ffa5-473c-9bb2-8c37bcf7464d", "comment": "Malware payload (Mirai)", "value": "5ff0cd3cc290f162189635e0d1856a1c974d27ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645488312, "uuid": "fb3c4977-61a0-4189-b43a-def6e7afcc05", "comment": "Malware payload (Mirai)", "value": "dbf82a115657acbeb6c11da573885ffed959b3b1865ee59088f9b1187703f562181177ebcdfe44083063fc636627e3ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488312, "uuid": "2433e5b7-5958-4a76-b565-a4c36b4e3855", "value": "T130E2D1F5BA565BC2CF79A96038C85BE4BBCA8ED470B5DA700148EFD0BC45B3650058CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488312, "uuid": "ba6c7b2b-c219-43b3-976f-350d4c24a00b", "value": "768:Dnt0Sa+xfgN8GzyoXbhm8uynq3aweXZOITuDeK8R4uVcqgw0RNWXP:DnlxoW0y8S1eXQIqP8R4u+qgw0bWXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645488312, "uuid": "665bc3b0-b6be-4242-813d-c3f682b12100", "value": 33244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645488312, "uuid": "23d28d00-ee82-49c8-a86f-00fe12e46410", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645488312, "uuid": "0017d51a-a53b-495c-a756-1c65424ebcfc", "value": "04ed52fcf8055d114396dbb924c03c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e526694-93c7-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645524368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524368, "uuid": "56c93e83-f5c7-43fd-9de8-587519fa767f", "comment": "Malware payload (njrat)", "value": "34f11d6afd3af1456fb499ba7296676e", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524368, "uuid": "a20f27ed-21fa-472d-8183-34511cbb0fa1", "comment": "Malware payload (njrat)", "value": "e1c8fbc6931af31a8c7d8a8a85792c44906728db795ca6df3f2d626c760c43b6", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524368, "uuid": "86e6de59-b06e-455f-b892-6ddcabe12b16", "comment": "Malware payload (njrat)", "value": "f262f5ede9adb3d9dca0e82cbccd9ce633653620", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645524368, "uuid": "2a8eae89-6505-4d40-a5a1-9d26e8e3352f", "comment": "Malware payload (njrat)", "value": "d09af5ee16b1c92cee61e216d980ff970acca9ec4f39bf64b619ddb3a3811be6354195ab9d382840c87def19ced61fc3", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524368, "uuid": "c53aff6b-b693-4ddd-9d25-4f2d3f178453", "value": "T14C33E22D5E23CFC9AC3C9F46F24C19B6AA879550F7078C4A529AC4973D731A0449BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524368, "uuid": "201daa81-ad51-4084-8197-4a254bdae601", "value": "384:xHHHHHHHHHHHjHHHHHHHHHHHAHHHHHHHHHHHjHHHHHHHHHHHBHHHHHHHHHHHjHHh:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645524368, "uuid": "d5cd75e4-db67-430d-9ec6-6b1bac1b314b", "value": 50319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645524368, "uuid": "b2283f1d-68de-4617-aee0-33f241bfb6d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645524368, "uuid": "ac09c9ce-8b19-4c3c-86d8-f7a8345c8d72", "value": "Status-Report.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98a171a-93ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645513516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513516, "uuid": "31e3abe8-1eba-4edf-8685-b1a17b3dc605", "comment": "Malware payload (Loki)", "value": "f191f865eb588e5f03d8ba4e08cdedec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513516, "uuid": "1c347b08-0176-4c7f-8a92-c403ad0b0f91", "comment": "Malware payload (Loki)", "value": "e1d54d2244d2ee82170a78ae2d63cfde1338a1678aca6679bb9f315d04ca4ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513516, "uuid": "19de7ec3-945b-485a-82a9-3bc82109de0a", "comment": "Malware payload (Loki)", "value": "fc2addd146e3de2ae456c8e1e006280979491b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513516, "uuid": "9b87411c-83e3-420a-8d9e-ec2d915b1947", "comment": "Malware payload (Loki)", "value": "3e8e5161dc858317ec01d0cd2922c77b2ed5c55a4dba48c10b8dfe6871bde7b105f47b3347a05bf34623ca8f264bc9d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513516, "uuid": "5e433aa8-4c1f-4b29-a2b1-d0d4d1504626", "value": "T16305CF142AAB5F3DF0BA4BB258D0DC74F7A9F6235C15F37D7C40259ACA52B408D822B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513516, "uuid": "a1af2767-7846-4e7e-8a16-d54d76bbce3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513516, "uuid": "31de4156-fde1-434e-bef1-f45b9ef752f8", "value": "12288:cgB6PuNfh7j7Pi3zgohrs8uP5xVBlpSZRiCbhjk5RpKzx8LVThb6K0ZCEehLo:ouNx63zgoMTiPiCNjwpK18LZhbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513516, "uuid": "494e8e74-5b0c-492b-a707-50ca6471c552", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513516, "uuid": "473b4ec5-1ee5-4566-b6d2-c49389b54cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513516, "uuid": "3fc1ffff-3f56-42d4-b2c0-dff674bbb18b", "value": "193026588 Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e717e25f-93a7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645510988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510988, "uuid": "278c351b-fec3-4965-a3bb-b15180f7558a", "comment": "Malware payload (AgentTesla)", "value": "964a85c842e91d6a91733a79903cbca2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510988, "uuid": "61a872b8-c2ec-4cff-a38d-cfea49ac3c96", "comment": "Malware payload (AgentTesla)", "value": "e261caf5df5feb1f76c5905c30fea72bd96f49e8ad54084366c63893c3e0cdf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510988, "uuid": "027bb04b-7210-4bdf-91a3-7364f531cd44", "comment": "Malware payload (AgentTesla)", "value": "9aadf050b7090cf670678cd7e23de3c1c87b8f23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645510988, "uuid": "8505c815-ac7b-4c6b-a234-20fef1171021", "comment": "Malware payload (AgentTesla)", "value": "c99e94390f2b35a146d11b9e7ddc455f38fb309771b44c8d71317052356d3b969a29db8334335d81f6d9fd3f5d9e26f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510988, "uuid": "8800c14f-1b8c-4c4d-957f-df4b06c8d93a", "value": "T15015CF543AA70F3CF0B94BB259D0EC64B7A9E7235C08F37E7C512596CA52B508D822B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510988, "uuid": "7a6c16c1-1090-4ad8-8f49-d41f8751a40e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510988, "uuid": "57e01970-d397-4315-bf28-d9b515e3b128", "value": "24576:uPNz7EVUHVy0UJ9kIuOwJqMjQFAcFqbdr:o7E200UJuIoqMjQFAaqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645510988, "uuid": "6913acd1-1920-476f-8243-bcc5ce2cb097", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645510988, "uuid": "5be969b9-82ad-4578-b59f-e4323f3de8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645510988, "uuid": "84f61806-f378-4ef2-9151-57302694660e", "value": "Price for QTN-0388-2122 dt.18-Feb-22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b485be7-93d2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645529303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529303, "uuid": "6a2b25e9-ebaf-4a2e-8994-545826fe8d32", "comment": "Malware payload", "value": "c94f1677b7278c0090961481586c9461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurgeStealer", "colour": "#CB6C2B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529303, "uuid": "c47a8fd7-b1f9-414b-9197-50b7c4d00694", "comment": "Malware payload", "value": "e279b97a4fcc8187136ca076d0bc25b9b7622483e8f26733fe2574485e6f3a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurgeStealer", "colour": "#CB6C2B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529303, "uuid": "ccaa8704-5405-40c8-bde0-a04df9f915e6", "comment": "Malware payload", "value": "704452bc5928f8afd32ae20650f28e573ad4b133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurgeStealer", "colour": "#CB6C2B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645529303, "uuid": "9918a338-cfd3-481c-ac49-1a3110e05033", "comment": "Malware payload", "value": "d841e70242e4c4bec2809d33732da4dd43fd0f88a7731ad2df629e56c004e14da89a8d5650b5812ae82d6bc8e010b9e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurgeStealer", "colour": "#CB6C2B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529303, "uuid": "993efdf3-c5bd-4af5-a9a0-1a9b62768a03", "value": "T1A8546B0A639A0CD4E9ABD13889838245F7B2FC514B02DBDF2290375E5FB31E19D7E685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529303, "uuid": "eae2e81f-69d5-4844-82ee-5fd20700b461", "value": "529939b14a0e5d7e4127b123ca186e6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529303, "uuid": "2280674c-b2db-46d1-a650-8077b95195e5", "value": "6144:YsVWsITC2aQc+TWYgeWYg955/155/ZvU1pPwkVzYrdsWlqxr6PbRseJZjV:YuWrlaQpWYgeWYg955/155/RFieJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645529303, "uuid": "925cf009-e383-44f2-a972-2ca70956ceb5", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645529303, "uuid": "33bd20bf-e551-4244-8809-d5ec112e67eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645529303, "uuid": "65ea9aa3-68b3-4c26-b4e9-f5a8960114da", "value": "PurgeStealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68f0ae8-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (OrcusRAT)", "timestamp": 1645518262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518262, "uuid": "5705cc35-7075-4dc7-a517-5c910024d5cf", "comment": "Malware payload (OrcusRAT)", "value": "e3df3c555ab6b865450e3b035b9c72d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518262, "uuid": "0e7aeac4-f61b-47f6-ba83-0915cfd609cf", "comment": "Malware payload (OrcusRAT)", "value": "e2e3187e91bcce330f9699b7d90e97b9ddd8ff92d1a9b5742ba15d8ea675e666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518262, "uuid": "c0081bd1-a3e6-4cca-a7b7-eeb8cd1ce0f4", "comment": "Malware payload (OrcusRAT)", "value": "ab06585ec4e96d2ee67abb5cdc76286285e1cd6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518262, "uuid": "3cddbd01-4f82-4286-adc4-fd30a44144be", "comment": "Malware payload (OrcusRAT)", "value": "17b7a06ae5f16ac7e12677d29a3d531b1813a386b335351e77709ce23efd020358afce5cc2f588a89a3ad9d96ad36179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518262, "uuid": "b412158d-6e3a-4f3b-88a9-882726540245", "value": "T1F615BF113BACBD07C1BE36B9B7732AC917B8E90A6042FB4E085451AD1D9BB01FE15367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518262, "uuid": "a0ce0733-c14c-402b-92e5-d51e2e586418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518262, "uuid": "e3661761-699f-44f7-bc48-902f07b1f99d", "value": "24576:S554MROxnFl3qzjrrcI0AilFEvxHPDooz:SQMirErrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518262, "uuid": "662a5b3c-354e-4066-904a-20ddaeeda2b2", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518262, "uuid": "f52418d8-8ae6-42ef-9ba8-71f2f21ec275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518262, "uuid": "8bbfa625-db2e-4edb-a0c2-fdd9f725f32f", "value": "e3df3c555ab6b865450e3b035b9c72d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a420cc-9403-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645550496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550496, "uuid": "01ff3018-1586-48a6-aaa9-d76a87e76578", "comment": "Malware payload (Heodo)", "value": "75237edca1fee066fbfcbf55df1fb41f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550496, "uuid": "5bca2bcd-9149-4a69-b9e2-06badc43da85", "comment": "Malware payload (Heodo)", "value": "e352db869302e744e01e9117359558a74b33956638f91fb79bc3dc2c27c64e9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550496, "uuid": "b9ad443e-759a-4abf-92ca-d55233d9d989", "comment": "Malware payload (Heodo)", "value": "9faa099c140eb8b056567bbd87ebbc8d65ad83fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645550496, "uuid": "47a1e1ba-b865-4015-98c9-12d347d2bb14", "comment": "Malware payload (Heodo)", "value": "e955b442bd32e09d7fdb096aa8a975412067f33ea34d44a70249200fe3a670730823eda3ef1247259186efee015b9a72", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550496, "uuid": "1cfc6023-3b05-4a39-a44f-eab4c073dfe1", "value": "T15BA4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550496, "uuid": "4434c41f-5c73-46cb-817e-75efb869fa09", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550496, "uuid": "693f2de5-4dbe-4d85-93c5-e7b218deaba8", "value": "12288:vicw4w2Vb0zq6k5Z2mTWjqkGXNrGHORQuBT:viSwub0W6LmTiwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645550496, "uuid": "dadfd4f3-f6cc-462a-8a0c-8b2c1579e670", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645550496, "uuid": "658516e0-cffc-4321-b992-23871443302d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645550496, "uuid": "03220eff-f896-4ed5-8dc5-b0d23f09419e", "value": "aKwfHXwjkS4KARkQQTH.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2717c792-940e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645554904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554904, "uuid": "4581d412-441f-49bd-aea2-de64ac111f38", "comment": "Malware payload (Mirai)", "value": "9cfbf8932debd735c810c7b8ab53adf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554904, "uuid": "ddb42a2c-ccad-4b02-a1d6-ed819f7f5cfc", "comment": "Malware payload (Mirai)", "value": "e3a1dd7e41cec3db32d0921d1c6244c86f52145aa99cb53a6acbad55b5cf4f77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554904, "uuid": "05bb5f43-a860-4791-b4cd-0c9c140b4473", "comment": "Malware payload (Mirai)", "value": "d9938a8ccda09ab1bc2e6f8985fdcf9bc53aaadb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554904, "uuid": "c69af486-a15d-4e8b-89ab-c082272500d6", "comment": "Malware payload (Mirai)", "value": "13c67ee7783346a6d922bf2290464b18859cf27e31b74079207361ab4d533a2621b1fad0933b95d2c68e6790627c4e6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554904, "uuid": "91fd7bcd-2b33-425d-b320-83630f52c743", "value": "T1D0E26BE7DD43E5F5E82516316036EF71ABB7D87E6194ED63C3A8A571AD02202E20374C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554904, "uuid": "f5825d5f-bd8d-44ce-b116-8a1d56c556b2", "value": "768:0VNpxHP98H9VtMyl0jZ1eigfBVWgGKt4ZxM/W:0VNpxHP98HVMH2igf/mKtoq/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554904, "uuid": "0ff79796-68af-4452-a343-02020ba6af9f", "value": 33552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554904, "uuid": "c4408e7e-ac27-4d77-8811-7e178ac9a7eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554904, "uuid": "92e6c28d-ed18-4bec-b024-25a812259a73", "value": "9cfbf8932debd735c810c7b8ab53adf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c3800f-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517623, "uuid": "431b098b-7ae9-4047-972a-4296531f47f9", "comment": "Malware payload", "value": "b129d7f54a40fc237b83c47839e98d51", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517623, "uuid": "d3e42f64-537d-42b7-a1e3-710732849e38", "comment": "Malware payload", "value": "e3d61cbbfbe41295dd52acff388d1d8b1d414a143d77def4221fd885aae6cd83", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517623, "uuid": "ab1fafeb-de3a-4dd8-9f99-cc6cf4c3088c", "comment": "Malware payload", "value": "e5e8a45d8eef52701dbc9b09726ca52807544acd", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517623, "uuid": "a70b69ba-13c5-4cb8-8ef7-5245c4818808", "comment": "Malware payload", "value": "ba171b57f2d4d452f76e002d55a0e31c38a8eb5387ab66a2df69d24d567227601b8568a029be32529c3d5f5d7c07cf96", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517623, "uuid": "e966e471-bc47-4626-af58-a8205f858e84", "value": "T19AF2090537EE5BB9E2FF8B7DA8B361004679B90A8411DF5D2CD8208D09B3B549952FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517623, "uuid": "bbf2f1dc-9936-4845-a964-5d783e2ff902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517623, "uuid": "051fc8a2-e865-4e67-9691-134a1cd85bac", "value": "768:ncZJmftDYYXeMRVstSCfc18cdDAhFTDek130fRX6:ncDmftC0NSxgcvDekH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517623, "uuid": "69b6458e-4fe5-4b15-9eeb-6f845976f27c", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517623, "uuid": "10479d7c-a733-4a6e-974f-cf6bc6967dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517623, "uuid": "d4179dc8-17a4-4357-8c9c-f6a30c5f4820", "value": "e3d61cbbfbe41295dd52acff388d1d8b1d414a143d77def4221fd885aae6cd83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb64a9e4-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645514861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514861, "uuid": "bcc18914-4da0-44c1-847e-75efd5492bdc", "comment": "Malware payload (Formbook)", "value": "14f378bb2eedce17aedabfa426905285", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514861, "uuid": "4b523a9a-17c5-4847-8719-01c7a4ecc941", "comment": "Malware payload (Formbook)", "value": "e3df3ec06cd08e67fa11bc0e8f0261476e6e8b57b7d6894c17773af544b8c93d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514861, "uuid": "fbf20176-f965-497c-a8d2-3ccd3d5abaa8", "comment": "Malware payload (Formbook)", "value": "e92f111355da4163b5b7fab9ddae30fe1aa24eb3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514861, "uuid": "4d40a7b6-7025-4d76-938a-a72d55b54278", "comment": "Malware payload (Formbook)", "value": "f5e98fd543bf263dfe1b7c318ccdace398ccb6377abf15fbd7ec30586611f0e478f7583cd541c282763b7868e20262ae", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514861, "uuid": "a6db0534-ea0f-4bdc-aa8c-4c7dd9ce79c9", "value": "T1DFF4339CA4EC0C3AE1107DB4C8AFC31A9B29157A990D587834DFE4F52D3F75A058C8E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514861, "uuid": "eb293f07-e749-4de4-a1fb-21092f44ae2f", "value": "12288:siwOqYUBN9rmaPd2KfNLLWA6xuVNiX/VWuQDsK7Bki4XhFQGrLPGRPqSC8ijLh:TwrBv6snfhLJuO+/ouaVy9bfrKRiStiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514861, "uuid": "9c876bf0-1b12-4099-9ce1-03be22120ee2", "value": 729140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514861, "uuid": "9450638c-a4c5-44ce-8a97-0759d831bb86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514861, "uuid": "c56dce66-6e30-4f21-9e88-f9ba503fefa5", "value": "\u0422\u04e9\u043b\u0435\u043c\u0434\u0456 \u0440\u0430\u0441\u0442\u0430\u0443.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854200fc-9425-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645564941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564941, "uuid": "36bd307c-3f7e-47b2-b324-1142d8fc52f4", "comment": "Malware payload (Heodo)", "value": "99badb1bf99196b661876f24e08ef33b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564941, "uuid": "e6dbfe01-59bf-44f3-82ca-365a032bb885", "comment": "Malware payload (Heodo)", "value": "e47d03069421e936ed81c09b8ecce4e4a9d3f35d23420937b89cf7778e1fcaa9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564941, "uuid": "f504de88-055c-4ad7-be4c-3ccf0bcdb7f0", "comment": "Malware payload (Heodo)", "value": "a42169903c9d16726b414fdbd106247c319b2251", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645564941, "uuid": "c54b6f69-5ca7-4ba8-a2c5-b060bea74bb0", "comment": "Malware payload (Heodo)", "value": "4b2339b7ff53a2076349dad60c260bbdb1ef68778c06a85410d08b2c2b89d245d340a40de26950bd09dbe2984be8ccf8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564941, "uuid": "4f50703d-cc43-4e68-b28a-d2d6ca051107", "value": "T130A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564941, "uuid": "3084747e-5b17-476a-99ab-ef39065682c4", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564941, "uuid": "16e97778-754f-40b9-aef3-00b710240abb", "value": "12288:vicw4w2Vb0zq6k5Z2mTBjqkGXNrGHORQuBT:viSwub0W6LmTnwNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645564941, "uuid": "e87aecdd-595a-4d30-921c-e151f9324756", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645564941, "uuid": "5019606a-ea73-4221-9d88-c11bd7afe2fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645564941, "uuid": "1495f383-bd55-4ba0-9f6f-668543ddd1ea", "value": "tREr8T6v7YJpQQGsrIwa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04ad1e6-942d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645568529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568529, "uuid": "271d7fb3-6c36-48d8-86f8-eaebfe8bad77", "comment": "Malware payload (Heodo)", "value": "08e29a71989dd262f0dc022cd1b3b22e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568529, "uuid": "0551376b-7279-4a01-8a36-0035fdab2964", "comment": "Malware payload (Heodo)", "value": "e480ba98a71aa7e2c7fb019a2e616ffd8d46396842f6c825a0f40ce651ad2e87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568529, "uuid": "d56899f9-c20f-48c7-87a5-6c40a8c20af1", "comment": "Malware payload (Heodo)", "value": "277229b39d252e6064eae075733781cd43ce7614", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645568529, "uuid": "0981d712-22ee-4173-a027-71b9aca58418", "comment": "Malware payload (Heodo)", "value": "ca9749094d0a9e1f3d1f33c78df864eaf81cdc31e7f50278921deb13dfaf5b850b38a0e7ac495ec312ada549d022241e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568529, "uuid": "8f11bed2-94ce-4d42-893f-3665a4044316", "value": "T18AB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568529, "uuid": "bf4d27b0-b1bf-4796-a295-1dd833173988", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568529, "uuid": "7f123556-14f6-4660-a0ad-87e0bb8a3c7f", "value": "6144:mv51rwubH3Z/C8N7u+kzL1wfIfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWwzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645568529, "uuid": "8b709550-42d2-4545-9c9a-95aee329eb92", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645568529, "uuid": "09fb8786-a75f-4b6d-ac60-98797a77ac37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645568529, "uuid": "f0f5df88-4b36-42a5-817c-3b6fe21002a5", "value": "08e29a71989dd262f0dc022cd1b3b22e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11266822-9406-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645551432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551432, "uuid": "7135193d-eb26-4a8f-8dbe-53b02336b31e", "comment": "Malware payload", "value": "f7c769ed6f2f67e4849e755cb8b3394c", "object_relation": "md5", "Tag": [ { "name": "E4", "colour": "#4951E8", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551432, "uuid": "f1dbed45-f1cb-43e9-8c11-2fe9804b0f32", "comment": "Malware payload", "value": "e49b364fce863fd49561c22b84385131f7c3120c51a0c642f5275f88b3ed113b", "object_relation": "sha256", "Tag": [ { "name": "E4", "colour": "#4951E8", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551432, "uuid": "9c112da4-964b-42f9-a360-a21027b04568", "comment": "Malware payload", "value": "4cc8c01bcedaf91bdf14e7d39de6fb3cdc51ec65", "object_relation": "sha1", "Tag": [ { "name": "E4", "colour": "#4951E8", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551432, "uuid": "f387c4f0-5308-449d-bb91-658b3308fc1b", "comment": "Malware payload", "value": "02d64f9fdecb8c445d33db7d2f5edeeb891711c24775177377de04a84955732b2015acde1619f93b0eb88908da0ccf5e", "object_relation": "sha3-384", "Tag": [ { "name": "E4", "colour": "#4951E8", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551432, "uuid": "e2097408-b0cb-48ae-bee6-7e60a815b6dd", "value": "T1A9930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551432, "uuid": "8ff4c061-e5b6-476d-8e71-804d021dc74c", "value": "1536:tyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAYkWvgrPE4nWHPNc2AJ:tyehv7q2Pjx45uoDGTj+5xtekEvi8/dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551432, "uuid": "b0c5c890-7469-41d4-847a-56ac1262fc37", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551432, "uuid": "e78d4c1e-8b69-46a3-b793-a8f103447a3f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551432, "uuid": "2dba0569-a86e-42b6-9a3c-86cdb763ab29", "value": "Scott Murdock Trailers.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b2f55f-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645518128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518128, "uuid": "ae0feb85-1040-4059-b73f-c6c42b079157", "comment": "Malware payload (AsyncRAT)", "value": "3a350a77020527b9efcffc641974e13c", "object_relation": "md5", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518128, "uuid": "7ea621f1-a7c0-4221-ba74-c2695bdd7912", "comment": "Malware payload (AsyncRAT)", "value": "e4d337cdae208c73c69d1bba2985af44350b904fae3b6566b90b44f985b76a3b", "object_relation": "sha256", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518128, "uuid": "9528c58f-253d-4cb7-8ba9-bf683b82501b", "comment": "Malware payload (AsyncRAT)", "value": "465031a1e571f9d7bc8b377b811fba725bf6876d", "object_relation": "sha1", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518128, "uuid": "7745bd3e-844a-4302-a083-3ffdf820b63c", "comment": "Malware payload (AsyncRAT)", "value": "5c882162c21ab84f355ebedb74df08d2b2e63484cca5a527c2a6fba0aef53246eb9105bcc5ea39d6ed0d3e3731c839a8", "object_relation": "sha3-384", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518128, "uuid": "bd51b9fc-61fe-495b-b118-8973e3b2815d", "value": "T1F225B3A9711072DEC85BC5318F749C78EF617C7A932B810F509739AAAA7D993CF140B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518128, "uuid": "1b0835c4-db17-4fd7-b5b3-94c2df6e02e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518128, "uuid": "447980e4-257f-4b42-8117-554f049252e7", "value": "12288:58RlSf/AMiOUPiFkVdAbn+9cx3Xj3Z5HMtd/IyL980DT4jtl4wGE2qBIFseCos8j:5kiyVdACaHjJ5wd/JjAi1qS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518128, "uuid": "f2e8408d-70c8-47f0-bb7e-81cc468908d2", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518128, "uuid": "84c37c58-7d94-4271-9417-7dafdb92b04d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518128, "uuid": "9a233bde-a821-4c81-90a6-22f65a863f60", "value": "e4d337cdae208c73c69d1bba2985af44350b904fae3b6566b90b44f985b76a3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ce0ebd-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645514509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514509, "uuid": "e36c5925-c2bf-4fc4-a44b-06b88626f461", "comment": "Malware payload (Loki)", "value": "3efab678b11336c8edffa4140bdcffe8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514509, "uuid": "b4f07009-ab7e-41da-8c45-8e1aded80bb0", "comment": "Malware payload (Loki)", "value": "e4f4c35d537599a5c643f314d9cfe7a7ac0fdb575280240fd76251018a788cdb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514509, "uuid": "ae357b85-9ffd-4685-b09a-1dc542d3a258", "comment": "Malware payload (Loki)", "value": "88f7dada634c6251183030e0fcca9176258ef486", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514509, "uuid": "229ce2c8-36b8-4973-adff-5a407166110f", "comment": "Malware payload (Loki)", "value": "d60b4ca1e17b79ece51551679cacad4758cf9c324ff1506f71a2afe0c8b53e2b71a77fcd523ee679afa769f67f2b67a4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514509, "uuid": "b4f9303a-f221-4eb8-a399-ff11f008c56f", "value": "T1B414125D7F4FB65CCDC3897829C383AF49E89D828AC154CF76983610A4759DB3C3922A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514509, "uuid": "d9cb7996-b2bb-4be1-9a72-4b0a599a88f0", "value": "3072:8O4bC7r5u1LLdppORd1jjPrx3MxBJE36IldhjX04HFIa4XCc28rAGUGtB9h7nEF:l4+7g1fYd13Pr0zu6Ill149rAGUI7EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514509, "uuid": "62a2ac57-f326-4b4d-9cc5-2e7fa377639f", "value": 191736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514509, "uuid": "920975e9-3175-4242-9f08-58e5122942f0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514509, "uuid": "2792106d-72bb-4fb7-a26a-0c9b89b47ff9", "value": "_PreAlert_YMLUW120522667.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbf87fc-9405-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645551342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551342, "uuid": "daf713a7-d66f-4037-a001-af23284a575f", "comment": "Malware payload", "value": "950fe379b6deb9296eba4129fec8689f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551342, "uuid": "9d27876b-3de1-441a-9381-04f47afe9bc3", "comment": "Malware payload", "value": "e5c5c2517ceada3b5855b38879b69b5f1643ec48cc0ade26c8fe928682ded644", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551342, "uuid": "5c32409c-4f02-49a8-883a-b7e5443596f6", "comment": "Malware payload", "value": "8147409b18a214bf468efdf285a5beb276574f0c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551342, "uuid": "d8242f6e-dc87-4d0b-9c7b-b64e7c60a578", "comment": "Malware payload", "value": "cbc175decfec3a53bfc1d9fbcd0aec205068006fb48594dd604d86d5d7e76aceacd23b4aa4b17d3cc87d2c377bab4b9b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551342, "uuid": "55de8a68-7f24-463d-94ad-489abab2ed62", "value": "T1EA93F769B681C95BCA5807344CD7CBF67227BC424E7987873298F32E2EB7650DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551342, "uuid": "3e20387e-e6e9-4256-b89f-77f21df2818c", "value": "1536:pyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAlkWvgrPE4nWHPNc2AF:pyehv7q2Pjx45uoDGTj+5xtekEvi8/dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551342, "uuid": "2f60b936-a22f-4eb1-8d14-64127d8a60d4", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551342, "uuid": "3149ebd9-0309-400b-af78-c589c22e6e18", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551342, "uuid": "33511e2c-bad7-469f-a332-109df1395f1a", "value": "tmpvzf8fu34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0b4406-93ac-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645512876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512876, "uuid": "b5bda112-338f-4699-afdf-732f72a198e7", "comment": "Malware payload", "value": "99450d718367ecac6075051d96baecdd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512876, "uuid": "0ebbd871-3ed6-4dab-aec0-f3305751e5e9", "comment": "Malware payload", "value": "e65f022296319e1c91116886792ce1046301ff677e02be2e284a1fd61b6428e3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512876, "uuid": "11cba57a-7578-4ac0-970f-95b11cf55cc5", "comment": "Malware payload", "value": "311bee60f0c48f2a2ce8a48edaca73ecb58d1a11", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645512876, "uuid": "73fbd4ae-f52f-4711-8447-0b4b62190094", "comment": "Malware payload", "value": "27902e22569ca951f44d027d9ac3bf68ea3d859c137b447dd6618dea9d47e4131857f09319432aaef57f88221a89ba94", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512876, "uuid": "cb5f6e4c-9bcd-4720-9a00-87d381bdb69a", "value": "T1E812297C92688EE9CF89A0E4A63AFC1901DDBE6513C4F6D73ABC37910B4527E8609950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512876, "uuid": "367b2230-891c-4739-ad1d-ce8ecfab12ed", "value": "192:UR+vh35GS67g5FLDz63xB3k5ppR8p1BaMoX7ZcZpk0:OQGS67Wh/OxB3k5pMtaMC72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645512876, "uuid": "cd97a734-6b0a-4676-aba1-f02dc5a44433", "value": 9465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645512876, "uuid": "aca24911-12b6-479e-a4c1-4e51f7a85cb9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645512876, "uuid": "f83155dd-db71-494e-914a-0bd2aae1fd28", "value": "INV-Payment request for SOA per JAN 31, 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5d1835-9420-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645562726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562726, "uuid": "3c1507b3-6d07-4a34-ab92-4a9a2eacbaf9", "comment": "Malware payload (RedLineStealer)", "value": "242b4d2ba93d02bbd337fdbc00ffb80d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562726, "uuid": "2288bbf2-340a-4a92-b03d-d3ea9a6817c2", "comment": "Malware payload (RedLineStealer)", "value": "e67b5e1f2fb6ab615e07315e4c5db283039258b1ba7d8214a43bd43db26d6b99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562726, "uuid": "19771686-4dbc-4571-baa8-b4ae17651d97", "comment": "Malware payload (RedLineStealer)", "value": "b2a79299f3ce4d92782c087439dbb5b3c7e7e9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645562726, "uuid": "95c085c8-3c03-4f9d-ba32-837cba8262b7", "comment": "Malware payload (RedLineStealer)", "value": "a9a5e5a09cdb55551595bfa64f8dfb3c2c64213448e63909aae20596edf49d4369bc30b91e7c15658d6f16548a424c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562726, "uuid": "95e74a3f-bac1-4b6f-8190-a7504a251bf7", "value": "T1253633E742E1F90CE9432D32964F8E12EF3CB30EED9859D1B1E58112A7756C4B7604AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562726, "uuid": "bd0aa9b8-6ed0-45a8-ad50-38273c739cd4", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562726, "uuid": "2fcc3e39-ddef-4eaa-973c-8c96093ef4d0", "value": "98304:3VIITKTm1dCM4pSJYQAQHKDFqWd4ey0K87pxvu0/2q6uqoYE0HaT6DLEcX:3VIImTm1dCMmSJtKDh2d87Pu0eq6uqoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645562726, "uuid": "6652d8b4-7909-4b7f-a49a-dbd07676f240", "value": 4910896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645562726, "uuid": "16be6d16-dd8a-4d8a-8bc0-b9331ed1b9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645562726, "uuid": "9a5137cb-50d3-4a13-8c95-5a40907a082b", "value": "Iobit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923dbcbe-9430-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1645569687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645569687, "uuid": "fd563965-fb6c-4fb3-aa9e-25e62d92a5fb", "comment": "Malware payload (DanaBot)", "value": "8bce39cd73af077e8a24360ad94cd368", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645569687, "uuid": "09952ad3-60f0-4b2e-96bd-f333670be8b8", "comment": "Malware payload (DanaBot)", "value": "e7a7032ddae1adfd64c4c378c6e97be7a2453228c7014a21d3945fc3ddc85d75", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645569687, "uuid": "360ecc95-afeb-4841-a207-76e98962933c", "comment": "Malware payload (DanaBot)", "value": "f761251b872215b0d34b76a53dd6b1452c6ca255", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645569687, "uuid": "91a6017b-5557-4b8c-887d-52abf1772f5b", "comment": "Malware payload (DanaBot)", "value": "965a4399c519738b080115097d16a8c48e60101f10aa8f9fd141e4ee05d60a5b0d582ca3cbb6d81dd259433098990512", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645569687, "uuid": "3c34ba56-b161-46c2-b68b-8aef03c14b60", "value": "T15154AFD131D2C4B3C59236358965FFE15A7BB831EA70B9473F78172E5E602D0AA2234E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645569687, "uuid": "2eab513a-1374-459a-940f-8595b86f06e4", "value": "a8880d90dd309ce69e04adb371ea8632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645569687, "uuid": "2415596a-c76f-4b4a-a1bb-13965d1ac8ce", "value": "3072:/VBXMaM+5XFX3Qt6+YmlTA60BWzad1J9c//scbipRXMj0VggjcGkNIVqI:/VBxB9BAJFlTAhBZ9c/0LJ7ITsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645569687, "uuid": "05d2afc3-3448-46a9-918c-74c2c5ccc599", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645569687, "uuid": "91fcc6e6-b5a4-41f3-a2c1-53ccc1eaf636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645569687, "uuid": "a480ef04-31b0-474e-88f8-7f0d619351c9", "value": "E7A7032DDAE1ADFD64C4C378C6E97BE7A2453228C7014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38311d2a-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554933, "uuid": "1c4c1fc5-23a7-4a10-b020-27f667681f5e", "comment": "Malware payload", "value": "adbfb3999f4d5a4f8623bde85153680a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554933, "uuid": "60a8dcf5-4265-4165-883c-8868c7ef5343", "comment": "Malware payload", "value": "e801bfd06bed58c91f21b9b28587d1a704d70bc75a58db435888de09a7fa4ca7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554933, "uuid": "25e85f57-e810-45f5-b9c9-f2e3bc14664a", "comment": "Malware payload", "value": "c8bfd29cb3849855f13c6e3b2e46c2e9f65bcc34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554933, "uuid": "4136e7a0-c7e8-46d9-bad7-c3a84c9e287b", "comment": "Malware payload", "value": "ca3fd5df20bc9f019c00d5f2250f00ab3392d13122025348b27967f753e6c176a39905c26902a4219302a91f27e79fbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554933, "uuid": "4123e0f5-1a3d-4773-b275-b5af61344258", "value": "T13DE23A91378D4957D1A72EB4263F27E1839FEDA020A8F6C4225F9A4B8171E334199ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554933, "uuid": "599df95f-c81c-4531-a4ff-1b6edbf71eb2", "value": "384:MSmSeKZQcgfAaJvzuWHMexAyHgkTlI+cv83YLdi2UIkVp1vERuh66hJThxAg5Mmt:n9KzJsIBdIhvwYc73wuwwp7kgDR0D1ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554933, "uuid": "7d346af5-3e85-423d-a421-060f79f82710", "value": 33888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554933, "uuid": "4744f005-f3cc-4537-bcbb-644c880b1eed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554933, "uuid": "b81e1c5e-0b2d-4264-8f8b-2354133c9919", "value": "adbfb3999f4d5a4f8623bde85153680a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b391951-940d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554482, "uuid": "a7825415-d3e6-489f-bf5b-05e90a3ed83f", "comment": "Malware payload", "value": "28ddfa22b3d141fbccf77afbd9afb4fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554482, "uuid": "8d80b9df-0a1b-456a-a1d6-3b4f09bd0016", "comment": "Malware payload", "value": "e845667dce2e7e36598e1fa36f9baf08125f73112a6495e784ccdb3e1c677dd7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554482, "uuid": "d3d143d1-c37d-4cd3-948b-70ae86d61285", "comment": "Malware payload", "value": "2a1cf80bbb57685b4b799e97eafbcf1ea6c04cf5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554482, "uuid": "22120c8c-3bb3-4af4-a4ea-89a54bcc53bf", "comment": "Malware payload", "value": "d982b4fc945e816cd22399cb37c9bf607ccbafe6bfaf1574b5ca062de3313be897ba3218d4bfbcd0aaf4f28faee3af40", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554482, "uuid": "4e8ae0d2-77eb-4c91-b4d5-9c5023bea6e3", "value": "T1C493F769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554482, "uuid": "6bbb46fc-f482-45d0-a0f7-639f9a9060d3", "value": "1536:Myehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQGKkWvgrPE4nWHPNc2Al:Myehv7q2Pjx45uoDGTj+5xtekEvi8/dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554482, "uuid": "d2727db7-bfd3-4da5-ac4a-910d30feb64b", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554482, "uuid": "5fcd96f0-79e2-4365-b3eb-843567a9ea04", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554482, "uuid": "5a65a532-d24f-45cf-858c-c641a8e07f32", "value": "tmp3p52rybn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85ce0ae-93af-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645514346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514346, "uuid": "2e90ead7-667f-4ca7-954c-5b329e0e1545", "comment": "Malware payload (Loki)", "value": "76e08a43f9cc04cfde810b3b4641642f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514346, "uuid": "c1c4d1ea-93f8-4d46-8a41-b7f28a449e57", "comment": "Malware payload (Loki)", "value": "e84ac241b527cc200b11dd14854e767e0b2de48b6fa287301812c41903d4106a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514346, "uuid": "6c29cb60-e1dc-44e6-8c6d-50f5d196de57", "comment": "Malware payload (Loki)", "value": "5d02fc7eae7cb86a4bcb986e2dd6f16adadeddcf", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514346, "uuid": "2016f9e7-c581-4246-9a7c-d6df67105c3e", "comment": "Malware payload (Loki)", "value": "33656e8531120bb19731881c3850d43692992433805aa094836c71ca2304b08579b14da1ec107d8ab11c1db72762dc6d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514346, "uuid": "24c37514-a345-4258-b786-052dad81fe4c", "value": "T1F814011DBA5B89F4E36209706EB0C07DD691BD257015BC0BA0AEFB2C35F8D6636106E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514346, "uuid": "c4dcfbfd-85a9-4a37-80af-f9e7d4aec084", "value": "3072:xXJ5o5EtL8II271ekDjgQPI0SPfoFs8de40h++f3sJFsl/ydwK22/UXVU9Q:1bwEtL8II2hkQBioxe9HfQE/yt/U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514346, "uuid": "ae954184-e38b-4a22-ae80-0f43e2d4599f", "value": 191912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514346, "uuid": "2b3e01b2-e25a-43db-9494-ed02eb4f4276", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514346, "uuid": "64f42c25-fb8c-49ae-b8da-c137cb4f5c2c", "value": "KOHT220200162.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0a2c2d-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528207, "uuid": "0ebe4a3c-0c52-4ee0-b45a-1b7739d6faee", "comment": "Malware payload (Mirai)", "value": "df46f23aea6dc77c020043a7aef30427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528207, "uuid": "5555ad15-48bd-475c-8811-88cfa8d4629c", "comment": "Malware payload (Mirai)", "value": "e8f0b3ddcc978f1afdd63a5503620051bdef17b1ac1d59d78652f04b18693e86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528207, "uuid": "9b60ca20-8662-4ad3-94e2-efa932ad9b1e", "comment": "Malware payload (Mirai)", "value": "fdc4b11628b571e9234aa7ef25445a77d95b73b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528207, "uuid": "2513843f-068f-4086-845c-0fd893a999de", "comment": "Malware payload (Mirai)", "value": "78bbb6afa4ed40cda0fa0c33ebdea11a7b80d8757f652cf34264e26a5b85bf3f31e823698baf97e33e18fd0412553b6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528207, "uuid": "8f2f170a-1592-4db2-a5ad-7fdc059e1817", "value": "T114233A41765C0E47C1A65BF4293F27E083FEE9A020F4F588260F9B868275E77518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528207, "uuid": "a7157a40-6fc3-4c50-b73b-2006af6abcbf", "value": "768:pUXIvf3MoLmX7TL7xEzPe4DVXRo8wVOENPsV+L+S+iBCBqO0pnKttABU0slW7pEN:9f8oLLS4DFqOENPsVM7+0QMtnvs47k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528207, "uuid": "854261ae-fa7a-4774-a18a-bcd055e580e6", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528207, "uuid": "bc695274-6554-45c1-891d-e7b2ed5cbc6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528207, "uuid": "bbc12b4c-6129-4590-b9de-cc091f2e1c5b", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b88f55-93ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645518766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518766, "uuid": "ae4dfb38-06a2-4de2-b7f4-d3e9ec21f170", "comment": "Malware payload", "value": "4121d572126c6f0f14faea7642467aa2", "object_relation": "md5", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518766, "uuid": "c8e1914d-e73f-45a9-8276-30fefe5da959", "comment": "Malware payload", "value": "e94d4acd1b3de7df03878ba8fef4080c08150c9485fef05cc87c13efd8f71c03", "object_relation": "sha256", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518766, "uuid": "cd2dd47e-f79c-4388-8f6d-eec3e4499c33", "comment": "Malware payload", "value": "395ac3e677e190e763a834d488ff06a1dceaa13c", "object_relation": "sha1", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645518766, "uuid": "a7245cd7-1434-4918-b3ff-57d3b14ccf74", "comment": "Malware payload", "value": "1c7e2b8ecbed2075757b8086ef4af4165ba5f24e48dd3fab0b6d2522e906b0adb193f44960e7b10ef9d168465e74b1b7", "object_relation": "sha3-384", "Tag": [ { "name": "103-26-79-150", "colour": "#70375D", "exportable": true, "hide_tag": false }, { "name": "KorPlug", "colour": "#C60FE6", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518766, "uuid": "0fe00807-dd11-4666-b6a8-2d72b83cd8f9", "value": "T10EA2E030F722D169D9BA503FA1B2DE2A5F21735D020FEDB2AD5B844B32379C8062D523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518766, "uuid": "e4632cbc-05ad-4600-a284-e8c4067d0360", "value": "384:B2NkxbBpXvCbg0bFVJYkY+o5zxEpx9XLb1hK003U3L3+Babq8Exn9djH:MkxNlJ0+kYNE79XLKU3L3+Babql/dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645518766, "uuid": "5b5f5f2d-11a1-40de-b62f-483234fb45e2", "value": 22260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645518766, "uuid": "5106fbf4-b09b-4559-8667-5c3da12c1308", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645518766, "uuid": "386c3601-7555-4982-b91f-dc0221cf2a14", "value": "e94d4acd1b3de7df03878ba8fef4080c08150c9485fef05cc87c13efd8f71c03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaae39d4-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645514860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514860, "uuid": "d8534c2f-cdd5-4c2b-bde4-0b57440a4bad", "comment": "Malware payload", "value": "211efdb13c9bcb3e1501d8206b49a1b5", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514860, "uuid": "c61b16ea-24ad-441b-beb6-cf223396fb35", "comment": "Malware payload", "value": "e9930a9f70c94c2d8bea1409074443c29ef0f40792bab1cbb158b93db8493b2d", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514860, "uuid": "060de631-ae2e-4628-bc6f-583544e20e1c", "comment": "Malware payload", "value": "7606a8ac84ed5ac421b4ed69ff04a059fae07ead", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514860, "uuid": "2f18c137-f403-4f09-890e-f79ffd1e7c7c", "comment": "Malware payload", "value": "402b73730381d5c4f79290f951fb63e5829fe5cc06d889c598e2ba1d3da4190bdb4e19769d43e83924b8fb8fb522cd13", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514860, "uuid": "d597cf25-516f-47ff-bffe-6fddcb0a56a7", "value": "T18C23C028C4411617C5B3693EC478D8E119659C17B214058FE5EB3A8F5B98F4B2B8FBCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514860, "uuid": "46f17112-839f-4163-b53a-fdbd236d7745", "value": "768:L0RD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnTCy:LuJqHt7NJECQFfqAEF2se+t/yx1/K8N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514860, "uuid": "6f1996c9-f62e-4593-9b4f-48ef73a99c5b", "value": 47951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514860, "uuid": "f8777984-2baf-4b0e-9d39-7124cecab1c7", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514860, "uuid": "a96b46cd-fa98-4192-a14a-da155d7bcb89", "value": "PO154302-022.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b156b1-93d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645531783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531783, "uuid": "f5f2e002-7fd8-4833-84e9-987d2e6b3320", "comment": "Malware payload (Mirai)", "value": "bcd6639223b9c578f1c2022428d85455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531783, "uuid": "800c2b2a-1f41-4fdc-9159-047b13a50bad", "comment": "Malware payload (Mirai)", "value": "e99c3e025a86d220938b44c82777a76d62a3081fa579a1867de65c6aa296612f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531783, "uuid": "f8995880-f96f-46a6-b2b7-6f4574d6f7f9", "comment": "Malware payload (Mirai)", "value": "f64bad8086b4dd4efc3da8386918f630c3803e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645531783, "uuid": "026147fb-122a-4504-b7c2-53950e1fd112", "comment": "Malware payload (Mirai)", "value": "2ea30001dc276157d51fc6e1dd4ce7d73e9f48afc1ea91f66a8f9a90967603d1a6da412fba79df9a4bb1bdc9017ca933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531783, "uuid": "b348d415-3085-4f13-acd0-394b35d68489", "value": "T19853AEB6C819BD94C8008334B422DDB42B63F40496671EB99E8789955487EFCF61E3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531783, "uuid": "b1c8926d-8665-45fc-a020-7f9a85ca620f", "value": "1536:Oa8tF/MUQ75ifwt1ARMAWJx/Naz/TlHmrmCwM:OXttMUQ75QmzCTlmrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645531783, "uuid": "4cf84f33-9ee5-40f7-8b0b-f2e73c9c7cee", "value": 63884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645531783, "uuid": "6e7cd05a-c786-49c7-ba69-59eed2ddfdfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645531783, "uuid": "f028c060-dfd4-45a8-b023-4744a9720e02", "value": "vcimanagement.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef7357e-9408-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645552287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552287, "uuid": "664702eb-5641-456a-a518-c77f16e32b6d", "comment": "Malware payload (Heodo)", "value": "ce91d56d87263438be6f5576e3050b7e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552287, "uuid": "c2014465-b428-484b-aa21-e6064561dbbf", "comment": "Malware payload (Heodo)", "value": "e9c8dea1d6c23447eaf5e2be39bb1879230536ed58d18af0cdb38b18259090d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552287, "uuid": "8f918e0f-e468-4281-a867-a562a6863a95", "comment": "Malware payload (Heodo)", "value": "f85149f8d2eb617f35d4badc887be6281ca6e6d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645552287, "uuid": "45d9387c-b3b1-43e5-b711-7d369d8414fc", "comment": "Malware payload (Heodo)", "value": "81f456fc2493154071dbbc8d12374593e6c50291355f070475e4b7269284ef422fd7b16391299c48b776743774787305", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552287, "uuid": "1bd52cc4-2306-46ee-8eeb-135b9af25a4a", "value": "T105A4AE21B6D0D432C26E30747A16E2B55AFEB9708AF58647BFC40B3D5F351D28A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552287, "uuid": "47b20562-7d3d-4630-a42a-014972e0d1eb", "value": "a63557e4e36a007beeb5ec927b9074c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552287, "uuid": "977a2730-7f99-428c-b4c6-9a960cd65d2a", "value": "12288:vicw4w2Vb0zq6k5Z2mTCjqkGXNrGHORQuBT:viSwub0W6LmT2wNyHZ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645552287, "uuid": "bbee6d17-8c96-4e51-92d8-116ab0492a6f", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645552287, "uuid": "94cfc77c-ea5d-497c-9709-646feece3c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645552287, "uuid": "cae9689a-c027-42c9-addf-1a0c01c0ce3d", "value": "m5PojwWm0ryqkw7XEqMT.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4392f271-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517586, "uuid": "f9cc4fc2-9654-4bd4-a91d-018fce281f33", "comment": "Malware payload", "value": "f20e34fbf3968e6a8dea795fbf925b6d", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517586, "uuid": "0b287697-d762-46b8-aace-0a719dfe5dcb", "comment": "Malware payload", "value": "e9e4a8650094e4de6e5d748f7bc6f605c23090d076338f437a9a70ced4a9382d", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517586, "uuid": "1ff8b54d-6df7-435b-9077-430218f0e514", "comment": "Malware payload", "value": "1f659192d7d838e651da03d131ed3e56e0a5a39b", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517586, "uuid": "17b5f9f5-2a76-4511-8d5b-9ba0bca315fe", "comment": "Malware payload", "value": "15839552967b1ab3ba41024a332823e3fa1ddec544f9544484cbb6a1684fbcc7a2b5619f8030092959e8dfc2f196f61d", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517586, "uuid": "76c74ab0-62da-4fc4-bce9-ceef78402dbe", "value": "T1F7A23902B7E85B3AEAFD4B3D9CF2465406B1FA025C32DF4D6CC4552D1E67B848A20B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517586, "uuid": "aae046d5-5e2c-42df-b958-f4ff8cc85d6b", "value": "384:BKqdR69QAxPgz/4YfFp/fli7wcroPDAXogeZlaz1i/nZCTCzG3cLHE55ff3VYW:BKt9RA5fl9cR1sZCTh3cKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517586, "uuid": "4e48a46c-4801-4575-9bd0-02ec46859340", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517586, "uuid": "2ea8362e-3966-46ff-b1e3-a583fe14a55f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517586, "uuid": "205a1f00-b01c-4607-8904-854f8d17c50e", "value": "e9e4a8650094e4de6e5d748f7bc6f605c23090d076338f437a9a70ced4a9382d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2fbd41-93c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645523508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523508, "uuid": "2e8a7897-c334-46a1-b756-fa57ceeb15f4", "comment": "Malware payload (Formbook)", "value": "a06588190e62062bd9fc0109a5351b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523508, "uuid": "fabbfde7-1def-4fd0-9d57-59bf263e3d2b", "comment": "Malware payload (Formbook)", "value": "e9f3be0c409dfce073fc55ea97594b0ff18f7953e1793cb7aa8a7c0f87549ebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523508, "uuid": "5aca613a-666e-47de-be63-6acbe49532d2", "comment": "Malware payload (Formbook)", "value": "c0d2b96a5aab317845df9efdc1ae62d36a2e7f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645523508, "uuid": "aa07b194-2688-431d-8a2c-8eee7f88adb8", "comment": "Malware payload (Formbook)", "value": "f9b26329ab2a72ba476d17822bc51e4b37914b2e6a89cfc71096a3b9b54114d28cd22e2a7d00ba4497395b568f66375a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523508, "uuid": "baa2212f-7acd-42ae-96df-7d9740f9e991", "value": "T10A12082A77C8C775DEBE06394C7367400775F20989138BBF6AC8D11E6D623C40AE1A79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523508, "uuid": "70683895-4226-4e20-8c74-f910fc55c581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523508, "uuid": "01f9ac5a-b797-4cd9-a784-b8fdbf6ea556", "value": "192:QqEjSjnvUxbt8n48WeLhuGWcAnHEHnBIt:QdHb2n41eLhlWcAHEHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645523508, "uuid": "f70a7282-8ca0-472c-9230-8447dd99770f", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645523508, "uuid": "0996ae62-71bf-4a29-a31b-dc886adf77e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645523508, "uuid": "b7aefd3b-09fd-4f02-98f1-cd23a9c7f378", "value": "quote best price list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e4d0e1-943a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645574089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574089, "uuid": "25b92697-1b79-4d3e-9fc6-688c988e0787", "comment": "Malware payload (Mirai)", "value": "be94178fe82e829b71071eacf37dbe74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574089, "uuid": "1be87a53-0a2c-46fb-b6a4-a1f24482b6f5", "comment": "Malware payload (Mirai)", "value": "ea19d3cbcb199e1577e16ff8bea5565959c5beb56e8880cea43806f83f15d7e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574089, "uuid": "41a87768-7156-4d51-a719-24e707de745e", "comment": "Malware payload (Mirai)", "value": "fbcb191d29b3ce162f1f23b11800c81222f347f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645574089, "uuid": "247df4a4-6c11-44a0-af3a-28fcee60aed9", "comment": "Malware payload (Mirai)", "value": "2d7c4dd4a2b05fa3a09a26e3cb41f85190a96ff24d4d7382d2408a190663c101f967cc36d96bd9384cb62cf0fe4acbbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574089, "uuid": "5b13d8c8-121b-452f-b893-5ee937677d95", "value": "T1D2A2D170D1CA5431C4F01936DC6DC74767B749BCA6D223B377980535DA4A45706FE862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574089, "uuid": "fb92fee3-9724-4ddf-ac20-2c4cd77715fe", "value": "384:7dmVsaOkfv+BPLyu5UrfxvPSZjQa8kykEV/uhTJu/mdGU5EwL:RBSnSeu2pvPSxN8HkE4FJi3UbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645574089, "uuid": "85acd571-0bb9-4eac-884f-2936a6634745", "value": 22276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645574089, "uuid": "6aa7b120-8e84-4e80-8448-b72007da9474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645574089, "uuid": "7b09a9a5-5516-4754-aa09-f7511093857f", "value": "be94178fe82e829b71071eacf37dbe74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd460a7-9410-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1645555880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555880, "uuid": "edd0ef0a-a5ff-43b7-93c5-b76e75c0f5a5", "comment": "Malware payload (NetWire)", "value": "7d4a9c20c15a7a067fd4085e7a7ceb28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555880, "uuid": "8534fae6-0f52-4967-b101-0980d7e02a9f", "comment": "Malware payload (NetWire)", "value": "ea43c71d7ec447e2483c7f0c8488972648209f2b487f2e6e64227d3d729c1d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555880, "uuid": "fd93cbc6-fb90-4099-b7e4-b3087cb77e72", "comment": "Malware payload (NetWire)", "value": "06335955cdc849f706363e45cb4a1176cbc49342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555880, "uuid": "c11ffe35-160f-462e-ab8d-7f6842f0296a", "comment": "Malware payload (NetWire)", "value": "2e6561a1f913273bde5536769c68b25577f8a5a5f457f2a9c3da38f4d48fb815db1c4441f22c4238d09c4aea13031536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555880, "uuid": "56af213d-4a65-4309-bc18-d0ca3dee62ea", "value": "T13B258E62E1608837C0771A38AD1B5654982ABEA03D3CD8466FE47F8C2F357453D29EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555880, "uuid": "2829a5ee-fb86-4ba3-be19-d2b58bd35965", "value": "fa9012f26f19d2b57997adcc6f3bb5ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555880, "uuid": "f090942c-5f01-4858-9881-7aaf6453075f", "value": "24576:AulcKxxVbDbzL4bMB8lh/XZ4EuuGKGw5WFd3/jK:AjSbYXqcgLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555880, "uuid": "65ab46e8-6c95-4cdb-90a0-199cd883704b", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555880, "uuid": "8b2d5532-c2a8-44bc-831b-55936ea157f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555880, "uuid": "9514fa14-3497-45cc-b582-32be955ca0f2", "value": "File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d28e0df-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517602, "uuid": "dd65ff8e-bac0-4a5d-ac4d-5f08dcf91090", "comment": "Malware payload", "value": "00e63efac941bafeda42b25209c67b34", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517602, "uuid": "b3fcaed5-23a4-4b84-b26d-03dc6187e72c", "comment": "Malware payload", "value": "ea740894227ae1df923997edb7bda3a00f523fbff7cc02d3b5e6b3de19d672fc", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517602, "uuid": "682067df-2521-42c1-ad1b-e48e53ae9eee", "comment": "Malware payload", "value": "ab2c61284d8bbdddcc579fcbe4044294fdc6b5be", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517602, "uuid": "e93f8021-6f9b-44df-988f-994f58bd292d", "comment": "Malware payload", "value": "2fcdc10b72335b983798b895a81cc7f2c9a8c7610af6e0d41a4e168ddc225ba54f563e4c0bf86cdd4d3063ed34eab66b", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517602, "uuid": "31bbb50a-a7ac-49c3-8c9b-ff8eab4ca8b9", "value": "T188E2D60A73EE5B64E1FF8BBC68B2615007B5B91AC412DADD7CC8148D08B3B585E91F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517602, "uuid": "6fef3bf2-2ece-4285-9b07-a3ecb5598baf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517602, "uuid": "d618bb5d-a0f6-476e-a519-8a63f129e438", "value": "384:IeBn3AEgDEEObCjGaC3bEaZfqzHtLrRdwUS7EY1F0bYHVhDLhWx5qBy3Ps:9BiTjcjlqzxRSRDLhc5+g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517602, "uuid": "15e495c3-e05d-487f-987f-998d844d05aa", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517602, "uuid": "d68b8456-6aaa-473f-96f7-d54b937af897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517602, "uuid": "38cf3ab6-85c9-4563-bc0d-797146982599", "value": "ea740894227ae1df923997edb7bda3a00f523fbff7cc02d3b5e6b3de19d672fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d384bc51-939b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645505801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505801, "uuid": "c48d33fe-705e-4724-9823-6a1afccc2f71", "comment": "Malware payload (Mirai)", "value": "b3f3e6a2917d06de4eeb3ff76fb7e05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505801, "uuid": "3c1ae8ad-86cd-497a-b52e-15ab7a10f18f", "comment": "Malware payload (Mirai)", "value": "ea7d5f2014fd5114ce1d23971a869ee688d7fb86f5a753253d58f5a639f0db7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505801, "uuid": "df26573a-3df6-43a9-92b0-e95428e492b2", "comment": "Malware payload (Mirai)", "value": "3b8b4b9e0b2666fc09bc0021bf39eb4a302725a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645505801, "uuid": "a8405822-e05b-4d62-80a5-73501843f335", "comment": "Malware payload (Mirai)", "value": "90c33bb28713cafb0550ee2381d1edc73f9d6e9c5e28a1b21e66969c6338bea07dedff5e5334c620ba73f3bb8ad991cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505801, "uuid": "ea35f019-d41a-4f74-b428-8b1c7753f088", "value": "T114D2F100B817F57EE2354C74ED3E464343D655F9D1DF706B0B800B99EAA20C76AAAD39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505801, "uuid": "f109e0c7-6a6e-4492-b3c1-03c4f839cbe0", "value": "384:Uyn26IXB18w1OZ3HTAxkob3E8Z65Fkl+ZkKQ9yvytek1W7l29Ui7WYrxX2iKCsQ0:S6IRDuj4Wkl+ao60k7UIzroS9q3UIsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645505801, "uuid": "8b65f8a6-7319-4c0e-a4f5-f51b626aaaa7", "value": 29340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645505801, "uuid": "7aabbcf2-e29b-473b-a8be-d7c32ffb4aaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645505801, "uuid": "c35489da-6ec2-4967-b73a-b8bdf6618571", "value": "SecuriteInfo.com.Linux.Mirai.1429.23910.30795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41570eac-9407-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645551942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551942, "uuid": "2ae4033e-ff03-42a2-a6ea-1112c7fb0638", "comment": "Malware payload", "value": "d32b6327f5c5f49fc2d6211f739e0414", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551942, "uuid": "78d5b9b7-187e-4687-a629-7c0f6d9e6902", "comment": "Malware payload", "value": "eb399cac8bd1522882a116ea60a9261abd9d6043d48ed4e05b037dbdb7bac3b7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551942, "uuid": "ce3d4620-93f4-4456-ad80-71d5f84ec53e", "comment": "Malware payload", "value": "9d0bf090f77a73522ae33cc41895aa15a2e64225", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645551942, "uuid": "e694b8fe-5960-48df-bac7-7e82ac6614b9", "comment": "Malware payload", "value": "f728f42049ddd825b44ce2c020cc3ee49436245638a911f8af66428bff195d0a2d1f5840186e5d03eea3872bf188d281", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551942, "uuid": "6cd3a52d-7780-424f-876f-ebaf7ce941bd", "value": "T18D930769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551942, "uuid": "fed4ab1e-4631-4516-9c92-835cd50dc242", "value": "1536:hyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAwkWvgrPE4nWHPNc2Al:hyehv7q2Pjx45uoDGTj+5xtekEvi8/do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645551942, "uuid": "1eef6b14-de70-435d-8f1b-6a31d4b4daf8", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645551942, "uuid": "c4a0e51e-2971-4e8d-be5a-f3664a714f5e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645551942, "uuid": "249ec0f7-b848-44cd-8ea9-0c01869e313c", "value": "tmp8a_u4u4g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b03f885-93ae-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645513652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513652, "uuid": "43f1049c-941a-403b-9e87-166dfff58dec", "comment": "Malware payload (AgentTesla)", "value": "a623a9a58a12607a87013f79a76c9d84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513652, "uuid": "c67f0191-7eaf-45ff-b4bd-f0de61cd8ada", "comment": "Malware payload (AgentTesla)", "value": "eb456bb20da3fd7cbf2c5b8742225d18d4fd0e44a4bc7463480a6068c278666e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513652, "uuid": "c976dd45-6290-434b-87d8-d5032741575a", "comment": "Malware payload (AgentTesla)", "value": "e7812c1d23de92a848e52255c659a9f207895c8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645513652, "uuid": "f43079ff-982b-4b24-99b8-ab8a540958d0", "comment": "Malware payload (AgentTesla)", "value": "8ade485d6dfca5f225f848635b887611c5626593884da2d03e576a28ef8eae82511867c77624d1328e6187b2e15cd674", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513652, "uuid": "6622d86c-331c-4a3e-83f2-7adbba3f3d4a", "value": "T1ACF423A9D47362A4EDBDF9FE3A026422BE049243C725B5611B50131F7A78F16D0EEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513652, "uuid": "bb11ee5b-7a23-467e-b7bb-ab5241948d42", "value": "12288:oBHHZb8eY1smidM7TxWkgMO5p1uwmtg70zCiNBBjdSEC3FyUuM9fI3u0i7ns95I:2HFPXdMMnMO5pXmy7kCi7BjfouM1ns0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645513652, "uuid": "6c435ccc-14c4-4330-9d79-0ab44d4daff9", "value": 739010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645513652, "uuid": "6c62d8ee-178e-4e3b-8a08-32c3323d0146", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645513652, "uuid": "81225785-da55-4ddf-ad13-e0298ad725f3", "value": "invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d19199e-940e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554888, "uuid": "8e7f8dce-927d-487f-861f-c2f26a59649b", "comment": "Malware payload", "value": "697e77f130c92cdba430fa8f55e7c839", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554888, "uuid": "0680172f-b9d2-401d-9f55-1ee101c8483b", "comment": "Malware payload", "value": "eba6302b0de77b80e64552f645e492794c9a5e3c6f6c417edc3ff10dbeef4181", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554888, "uuid": "3cc23ee3-ed28-414c-b3db-924ad3014b3a", "comment": "Malware payload", "value": "0576b28009605f6d7b069cca614e754d3e5974bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554888, "uuid": "9970433a-2050-483e-9184-cdc7659cddb8", "comment": "Malware payload", "value": "7b82f826d72f7cb0fb32523a778f94fa0b93f1722ac93457750f6d88f38e4dfc427e913719c973230142fdf29bdad1ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554888, "uuid": "a78a4e42-fc54-4496-9aed-110e904bde3b", "value": "T1D5239318AFA24FB7ECAFDC374AE9174525CE540A22943B7A7834C818F24B24F55F3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554888, "uuid": "e51ae131-1c58-4e71-b013-361787df5965", "value": "768:x+9JgcLaRDrXrlYsmpJu+G5NUeJlrGnGZnMLXij4Be+ZD1oQ:xOuiaRpYsmpBGoMlrGGZnMw4BGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554888, "uuid": "dc016b89-7ffb-4e1c-9fa6-edcde008e5c6", "value": 47068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554888, "uuid": "1ef41a49-b024-4803-8cf5-bc8fb19fd7d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554888, "uuid": "3de5f3d7-0ee6-4d60-87cd-b7145c4a3c9a", "value": "697e77f130c92cdba430fa8f55e7c839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e955fd60-93cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645528172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528172, "uuid": "89e86d7d-5d93-4418-930f-e54931579a37", "comment": "Malware payload (Mirai)", "value": "1241775ea55b2dbba2344b2dcd26cdd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528172, "uuid": "0f175ccc-ee6f-4619-b1cd-e84bc81fd98d", "comment": "Malware payload (Mirai)", "value": "ebc9304b27f6af9b29ee33ca51e33b3d26bf33caea9ea8ac140cdf85622a6201", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528172, "uuid": "19cfc1f1-9f8b-4115-9c2d-15fae5ce6b76", "comment": "Malware payload (Mirai)", "value": "fe553e09e9fbbb95e558218b8ecb3203425ebd18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645528172, "uuid": "78afbc6d-76ce-4e33-90cd-462719306d3f", "comment": "Malware payload (Mirai)", "value": "20d37d712085f218ee3fde08d1703f4b47a215b1a1e8116d171f0db20b1629312473880eaf52168e319319e225d5961e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528172, "uuid": "a3c291ff-f0c0-4b1b-9324-96a223002b8a", "value": "T13B331981BCC29912CAD42376FA2E01CD332663A9D1DF72179D216F5137DA82F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528172, "uuid": "e86a5559-23c3-476c-8775-401d3463bbd7", "value": "768:RXoGCh6mppCK2FdThNutUGUiT5lBCC/L0wIefWBJNoiWBMBNwoxBA1sL9AdE:1oGaTDC7F4Uitl0K0wIefAJqOxee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645528172, "uuid": "232c56ab-acc0-4cb3-8dc9-ed97ffe167c3", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645528172, "uuid": "4d9dd3ae-7f4f-43cc-bdcf-4e226c56ba7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645528172, "uuid": "2f6b3154-9ad5-439e-9512-8100f0b06bee", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94aa052-9418-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645559525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559525, "uuid": "e93a9106-d8c2-4a45-afd1-069f7f15d7cf", "comment": "Malware payload", "value": "645c067d0dbec6bbfcb696814f4ed972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559525, "uuid": "a092caab-36d3-4ae1-993d-238ff576ac09", "comment": "Malware payload", "value": "ebf4b4b9ca75c5df802f233121769e85125b2d21d9f97a7a04577efedc66f430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559525, "uuid": "3496694e-a5db-476f-82f5-572f1880e10b", "comment": "Malware payload", "value": "fed7431df34c8822a127e1c6a39d5bcbd144ff53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645559525, "uuid": "0e471d64-804a-427f-baaf-d1d0683eefca", "comment": "Malware payload", "value": "d0bbeba6238ab618f26bb80e48f6f80a69e435180adc060f912c91a125d29b1dce64febd75b2a573582db9f7d1f7e1a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ogoxts", "colour": "#D62563", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559525, "uuid": "9f8d055a-a9b1-4fae-8132-2e007f934b28", "value": "T118132966A65588B5D8B6C13A46433DAAB7F2F0380330D7AB570618DDCE6F7E42D39780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559525, "uuid": "5888b348-d695-4ee7-bec4-f4b05ddd6d9f", "value": "33869b3d88652564be35330499e83ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559525, "uuid": "c3b13eba-181d-4bfa-9cef-c6341816a622", "value": "384:uDAsTpioc4ha2SW8M61NVh4MeVcqqsAXM7ZgHhWovhAmUXCVStIOwSHkdW0qeNgX:uM8ha3W8MgNVAeHhrvKChBHOu3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645559525, "uuid": "79e79536-a0a5-4987-885d-9a8cbba6ded3", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645559525, "uuid": "718158a7-24bf-456d-a4f2-81621dc93060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645559525, "uuid": "b6348f01-44a3-4a0b-9e0a-5cef8393d0e0", "value": "dll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b146c0-93e9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645539333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539333, "uuid": "a9bf3144-ca0a-4477-8d62-01c26943b144", "comment": "Malware payload", "value": "2245818438d0cb3681f0d48ee01b858d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539333, "uuid": "97e348bf-049c-423d-85e5-9cdd8b424f1e", "comment": "Malware payload", "value": "ec1f1f5d96fc72f69be2290d5b3b81ac725bebe8dcd92539d5e15af3da4ce67c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539333, "uuid": "7f5c3275-fae3-4e91-b9f6-d8ce5a4127be", "comment": "Malware payload", "value": "e55c8cb2422e5c060c65b88777d2654ecd754a34", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645539333, "uuid": "02c45fe1-5474-412c-a324-815cde5f98d0", "comment": "Malware payload", "value": "3d494c298598e2f66db9c46edb13be5dccc501ea2d5c0681649575fa4f8b65f5d8be90f569988aad6dc57a70e5b6d327", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539333, "uuid": "acc8f81f-d167-46e2-8bcb-e56529f860cb", "value": "T1D4F4239079C5067E9F6D11FB1A33355EE5FC6FC0A0004B283721EEE2457D785AA6E22B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539333, "uuid": "44f9de7c-1cf3-4cfe-82fe-83dc6fe0e263", "value": "12288:DgF3jHYynaXobutkGBOY/KQnaY2Xv7409cHRRqjXtXVNpRmhDJi0S30G2LSKmnpc:D43j4keDtkGYY/fz2Xz4ScxRkXtXVNpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645539333, "uuid": "8992a079-54a2-448f-8395-a3434d1df4f0", "value": 758597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645539333, "uuid": "1e48ccd5-cdd9-4879-b8e1-ca899a307447", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645539333, "uuid": "79359f2f-715d-4957-8417-d10fecb4da17", "value": "PO 700005470.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8181c570-9400-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645549043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549043, "uuid": "e8ffe8a8-6179-450f-a25e-c4d8cd282a0d", "comment": "Malware payload", "value": "3175c9c70b39d3288e8223a779cee3c0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549043, "uuid": "c86387bc-f13d-41a8-adaf-004211bbc300", "comment": "Malware payload", "value": "ed180371dfec2186148bbcab99102ce45fb1fcc3764b384c2abcaceba2fa65b6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549043, "uuid": "7db9242f-033e-4394-9c1b-783ad9d7e1a9", "comment": "Malware payload", "value": "d6846d6c469321b6b081f7c2be23ec9fcee8325e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645549043, "uuid": "a9b747e7-dd76-4a73-88e7-e1755a339905", "comment": "Malware payload", "value": "a163febf0365c7ef7e91b063aba208e020e0e6996d9dbb528d214b9b5267254565ac8febbc0b9f96307b6e9aba490931", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549043, "uuid": "8824c780-4ef0-4c24-afd2-a94df50e5a89", "value": "T17593F769B681C95BCA5807344CD7CBF67227BC424E7A87473298F32E2EB7690DA43711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549043, "uuid": "529de4ae-753c-4fa5-8a22-aaf84c5e26fe", "value": "1536:8yehv7q2Pjx45uoDGTj+5xtekEvi8/dg98EsAeE9jbDXQ4Y1kWvgrPE4nWHPNc2y:8yehv7q2Pjx45uoDGTj+5xtekEvi8/dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645549043, "uuid": "9d87f4c9-42a7-41f4-b041-349e9985c9f1", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645549043, "uuid": "385c4e2e-5ce2-4b31-846d-ec42f6da36e8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645549043, "uuid": "0fa70438-addc-40ca-8648-2936d03fb730", "value": "tmp4bn2zi6t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475e4464-93d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645530048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530048, "uuid": "823ab655-4c04-470a-b4c2-51022cf5e760", "comment": "Malware payload (Formbook)", "value": "0d922dcb1390ae2018806bd6fa6ecdd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530048, "uuid": "2f5286e5-9ea2-49b0-86fc-2fe2939e36e5", "comment": "Malware payload (Formbook)", "value": "ee22052175ffaf0e2168c716ae3fc165305c2bbba68e753f0e7f037b5cd1b2d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530048, "uuid": "62ce01d2-fa09-4f2f-8710-dac9786ece8f", "comment": "Malware payload (Formbook)", "value": "e61ba928c5139284faa2cd17e649f48ffece545c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645530048, "uuid": "4961ef86-7e1b-42e3-860b-73919f8fad6a", "comment": "Malware payload (Formbook)", "value": "00d0f8e97ac56edadea139988eb93931c5d8fbeef3ca59b34f81eed7fc94e4dc297e0b0fcad9a1cfcf0bacbbf266dfc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530048, "uuid": "cf70397c-e427-431e-b1d7-101618f43475", "value": "T17094E092E556C1AEE8B84331E4A7EC211E632D29F970696E598975203BB37C3503FC1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530048, "uuid": "e7ae4a50-4634-4db3-bdd3-46cd11a0e104", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530048, "uuid": "fc9e6d4d-e99d-4baa-9fee-63d6cc6fd1f3", "value": "12288:Ix71SLNM6YdpoYEbuIq/0xYRHgKpLxYVI:8SLNM6fyIi0xRgLWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645530048, "uuid": "8d05430f-98ad-4802-9e88-edbadf2f1b71", "value": 416090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645530048, "uuid": "97cef0a6-c735-44db-bb4f-0b242564e150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645530048, "uuid": "efa6e283-c257-4854-87ab-2111945b82eb", "value": "INV-DHL202038658530.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37798958-940f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645555361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555361, "uuid": "e7ae346d-c0f2-452e-904f-5fb08f154c7b", "comment": "Malware payload", "value": "a16643d2f0d6e2951117dd3b8a061206", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555361, "uuid": "d470dbd5-f51f-47e2-9f22-ecd2ff276ba0", "comment": "Malware payload", "value": "ee3dbfef1d114104ec155329bf69e3283ecf59991d76ffec0f04cc7e4c8644de", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555361, "uuid": "a75688f5-09ff-4e9b-b0b9-1eb65da44266", "comment": "Malware payload", "value": "c96f022304f52286b55499413a913a0aac5f97a8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645555361, "uuid": "45801496-5592-42d4-bb6b-8b694a6abd5a", "comment": "Malware payload", "value": "a490d49dd294f361cae328bfd54b3dbbb0f8116e52f3280abef88b5a2e37e599b5b6b8407cb5e69af2e275e577dd7f75", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555361, "uuid": "2c0dea7f-5fdf-4185-8784-e0e2f3b70655", "value": "T1FC93F769B681C95BCA5807344CD7CBF67227BC424E7987473298F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555361, "uuid": "a8d25d2b-d01f-45b1-89da-cdc24857c3be", "value": "1536:Uyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQxdkWvgrPE4nWHPNc2Al:Uyehv7q2Pjx45uoDGTj+5xtekEvi8/da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645555361, "uuid": "2ea3beab-e9fa-423b-ae03-72bfd3b17a53", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645555361, "uuid": "20b9460a-097f-495e-894e-82adb563e998", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645555361, "uuid": "d58b587d-4b54-4484-829a-e252bd9e6682", "value": "tmp495b6crp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c68c3b-940d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645554795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554795, "uuid": "1ebda7c0-ad58-4182-b17f-27ee11a0612c", "comment": "Malware payload", "value": "6b08be306e591503e27c04e5d596ac5e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554795, "uuid": "1dcd7fe0-15b0-487f-967e-79cef0988a82", "comment": "Malware payload", "value": "ee4cfe35578ae0d2415d494d8d569001e2cc1cf68dfeb3f125a691fd1ebd0e48", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554795, "uuid": "b5eedba2-99bc-42fc-94b3-ef1866149c93", "comment": "Malware payload", "value": "3ef450e02f21328cbe2588f4a10c24332d986412", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645554795, "uuid": "e7a1f8b6-c6ef-4da7-b4d9-e11ea7e7994e", "comment": "Malware payload", "value": "d9de4702748ec54bb1f2cdeaeb0304707637327486044a10aa4bcacb0a77138dce51ff9bdeb9739e534480e57e57d013", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554795, "uuid": "3f1aa96f-f868-4627-b661-12db5218a1ba", "value": "T1DE930769B681C95BCA5807344CD7CBF67227BC424E7987873258F32E2EB7690DA43712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554795, "uuid": "d2d174ac-11d0-4422-8776-f1dfb191d9bc", "value": "1536:Cyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQG4kWvgrPE4nWHPNc2AV:Cyehv7q2Pjx45uoDGTj+5xtekEvi8/dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645554795, "uuid": "e04f2516-e579-4ddd-87b5-b484626e21ad", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645554795, "uuid": "f7da988b-711f-4f8e-9812-6cd1e541e175", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645554795, "uuid": "145b84f8-7b88-422b-a1aa-0ef8ea11290e", "value": "tmp_85dl9w_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a041eef-9427-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645565781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565781, "uuid": "9afcf91a-4cac-4afe-b8c9-2025e8d81423", "comment": "Malware payload (Heodo)", "value": "e04de12eec3a50b05721fda606285ece", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565781, "uuid": "d6dd2aab-91f7-47f3-9f36-601f8f182573", "comment": "Malware payload (Heodo)", "value": "ee8363f9399cfdb1a4ab0e57d24988230bbf46c1316064f694eca211bb9a6ab6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565781, "uuid": "34483eeb-53f0-4ade-856b-877cd3ffb362", "comment": "Malware payload (Heodo)", "value": "b48c94ac7844d4850b3fc8cb54e78f1e4ae49924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645565781, "uuid": "7d0a0de1-ea7c-48e6-b9c6-a1b3cd38f4fc", "comment": "Malware payload (Heodo)", "value": "8bde4bb20cabe9951cc7057b54ae97064e47a1456b516fb269614e07b2f320e80a9ee47b10acc3438ba4d51d14da7ad8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565781, "uuid": "740da9fe-3f92-442f-a6b1-ecdbbb5ef0ea", "value": "T10DB45B307D50E871C3679CF81602269691CFE7F0CB9AB6BBD6D8015C9BF45D3162A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565781, "uuid": "5f0134a6-85a5-422f-8d34-bc1585830033", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565781, "uuid": "9ed84ed6-7533-42ce-a33b-6da7275d1c46", "value": "6144:mv51rwubH3Z/C8N7u+kzL1w8IfWxXoo01QwVRou5jfboKsQZkQzwC33fQY:mBdwubXk8N7KzWbzo0hToKsRQMC33/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645565781, "uuid": "cba20cd8-9904-4a17-b92a-839c5fe3fd90", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645565781, "uuid": "1bd9f17a-951b-4af8-8ef4-0eb04c1c2ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645565781, "uuid": "e20bdaf1-43ba-410e-b7fe-c50f39ef34a7", "value": "e04de12eec3a50b05721fda606285ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c64524-942a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645567003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567003, "uuid": "1b70f548-f4fa-4369-8796-3ea729b1cb5f", "comment": "Malware payload (Heodo)", "value": "b28f6867b70d085674688ca85ea4c54f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567003, "uuid": "3fd1a6bf-51f6-4f8c-952e-0ef274ebccd2", "comment": "Malware payload (Heodo)", "value": "ee9f7b9baaa2b1565c13d8b49a354dfd6e7e50adf05bd24ab2412cabda14cbf4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567003, "uuid": "582d09b4-1b69-4a24-87e8-c669eb763e39", "comment": "Malware payload (Heodo)", "value": "c764d749d5e5f95ea7de2ff18084e47bf56f62dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645567003, "uuid": "50c9e4ea-a5ba-4431-ad5f-280acd424413", "comment": "Malware payload (Heodo)", "value": "b85798ef34e5178f791c30cc3b3411b9096eceeac09ddaf175114ee93452fe369766e6738354cb0600b7ae747232b37e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567003, "uuid": "569cdafd-3212-4a1a-9759-42f81bf1f448", "value": "T199B42902A612F13DC28FA0754D016A65D0AEC8E5277277E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567003, "uuid": "1562a43f-be21-44cb-9940-d770811e46ec", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567003, "uuid": "85e2a47b-2dcd-49c3-bf32-8d22079b1744", "value": "12288:IOzyEtBX2ZHq79+f6/G5YgvmgZDa6A9TU:lnmZKR+pYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645567003, "uuid": "03b52ebf-d028-4767-9391-cb0af565890a", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645567003, "uuid": "c4910d63-5cf0-4db2-b6c5-0774c3a69016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645567003, "uuid": "d5999040-8365-4466-99df-66c9e72dda46", "value": "emotet_exe_e4_ee9f7b9baaa2b1565c13d8b49a354dfd6e7e50adf05bd24ab2412cabda14cbf4_2022-02-22__215638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d12d8b-93b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645517543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517543, "uuid": "a97e2cea-de2c-4e98-a35a-b82234eac20a", "comment": "Malware payload", "value": "c2dd46819691d545ba0c6e18f0d173d3", "object_relation": "md5", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517543, "uuid": "2112bbed-378c-43cc-8fc2-3ab5d8c76b04", "comment": "Malware payload", "value": "efc8f12c53d1730fa8ac00cfa60e63ab43d90f42879ef69d7f6fb9978246f9cb", "object_relation": "sha256", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517543, "uuid": "01adc148-cd5a-4350-a38a-fff65dd4c975", "comment": "Malware payload", "value": "39b634c7d8138147a7db7bd75ee8e5acb0cae862", "object_relation": "sha1", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517543, "uuid": "de124a37-e954-4486-9f6d-7ed2e870fe43", "comment": "Malware payload", "value": "d26ccb859846cbf6010e3ef6bd82f049c10d22eafd8456a8a0e452b5d309886acca63b35d85b8e030358881c2d2adaad", "object_relation": "sha3-384", "Tag": [ { "name": "EvilPlayout", "colour": "#0DC6BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517543, "uuid": "dbcbc0c9-9bf4-4768-8392-4b21d41bf3f9", "value": "T1A5C08002C902D1C43483A540C34534C5370DC45A417C5B1513C7972774D5FAE67DEBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517543, "uuid": "f09ab91d-ac88-4d05-8ad5-4bd271a18bd9", "value": "3:mKDD/WPJ1syMb4Av2z8XZjWcjsFkgWGyMb4AbXRFn9mbZjqWvMWyErvKWIALRn:hSPHsZ4Lz8cSseJGZ4sEHxyEeoRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645517543, "uuid": "d72109d5-7efd-4216-a1de-69ba5449a499", "value": 182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645517543, "uuid": "0dd3653d-8a09-4d61-89b7-4cb6cd53acfc", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645517543, "uuid": "fffde330-c10a-4427-8a84-a46726d1a938", "value": "efc8f12c53d1730fa8ac00cfa60e63ab43d90f42879ef69d7f6fb9978246f9cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1014839e-93fb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645546705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546705, "uuid": "c0404e41-3953-4912-9283-8bfc8e79932c", "comment": "Malware payload (AgentTesla)", "value": "168063318185e73f615872eabd760189", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546705, "uuid": "af95c041-cb41-45a1-8cbb-6e0ccbb3ccf8", "comment": "Malware payload (AgentTesla)", "value": "f1aaed342889247bf9a2d98a137a2b60a796cb6cb0e41bad70356ef5e1422c1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546705, "uuid": "5f5a83a7-81e7-4db4-adf2-044b2faaee81", "comment": "Malware payload (AgentTesla)", "value": "1a683592b7d9cd052c940447a21fe74f507a64f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645546705, "uuid": "52417916-35ce-4bcf-8cd3-1c55cb057613", "comment": "Malware payload (AgentTesla)", "value": "cc05cb0ecc7fa2bfa1943740e991e4cd7af97532ef7fb985af12a210091718769445ac88891f6457a70905555b49cccb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546705, "uuid": "7c458456-c308-4824-9520-32fa07479cdb", "value": "T1A8355C9D365072EFC857C972DAA81C64EA60747B930F9203A06312EDEE4D69BDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546705, "uuid": "cc44bd88-d57d-4c39-839a-cc64341613d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546705, "uuid": "eb162846-7b87-4e2f-9d22-8a97ecf6b197", "value": "24576:+RGidmUUllmEBvjbEb6vNW4u464A66VJrOHur:gGKmUglmavjgb6FG46v66H6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645546705, "uuid": "db814b86-f143-4ee6-9378-3acaa93104c4", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645546705, "uuid": "90165c27-b09b-40d3-8c2c-1676ed0391ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645546705, "uuid": "e0eb9a69-b981-4a8b-856a-38feefc0cdbb", "value": "Shipping advice - 2nd container.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433cdebc-93b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645514579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514579, "uuid": "2db78ea6-b095-435c-bed8-898b8ba4083e", "comment": "Malware payload (Loki)", "value": "1c5a65b7aa96ef95fc9ad20af3c77462", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514579, "uuid": "0e40ef07-5fa0-4639-9067-ad584ac43166", "comment": "Malware payload (Loki)", "value": "f1ee44646b6ae315e052a6c602c9d0219d79ef0868b1669e7becd5fa2c445f68", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514579, "uuid": "0ba02b54-fdf9-4cca-9bf1-ad02b675a143", "comment": "Malware payload (Loki)", "value": "67b58e45137faca4263684776d90db03e05afc36", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645514579, "uuid": "cd37bdad-1af2-4273-8f08-1c63a51d980b", "comment": "Malware payload (Loki)", "value": "617e31f3ff7c167b8f98196976f431f9601893cb613fe847b83b55a7eaa4d62d363cf9d847eced4fa627d611526d811d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514579, "uuid": "4b5b5723-c37d-42e9-b121-ea0fbff79058", "value": "T1FF1401047359B320D20F99BE3C71C13516DBECB81FA424AE7858B44A877EE5D0DBD6A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514579, "uuid": "75c2c443-0f26-4284-9823-136cf2037be3", "value": "3072:rvnKcGAKbRifgcYQl/t1sBmPW1NOVJq8d4xbGIfWffNcz01/gXi0:Lz1iiocYQl/tqBmPb8m9ize/gy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645514579, "uuid": "b0008965-c39f-4cf6-a553-5e6a34299184", "value": 191864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645514579, "uuid": "fb4e2315-e3f3-49e7-a4d3-7d0173181470", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645514579, "uuid": "e378feb9-1c78-4261-ad3e-5551f18cac7f", "value": "shipping docs.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6eaac4-93b8-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645517923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645517923, "uuid": "ccdf9527-7aaf-4a0b-84bd-be71485afec3", "comment": "Malware payload (AsyncRAT)", "value": "5a3d4d49ce44e46edcfc36f46b1274a1", "object_relation": "md5", "Tag": [ { "name": "20-123-180-103", "colour": "#A3FE17", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false