{ "Event": { "published": true, "date": "2022-04-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-04-23", "timestamp": 1650758581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "918ee4d2-0949-41e7-a826-f9eae59a36e6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a1b1fe-c2cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1650694077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694077, "uuid": "707ae2e3-1ef8-4ea6-976f-494787a59988", "comment": "Malware payload (Smoke Loader)", "value": "ffbfb88c129bf711d84fcd56677322f6", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694077, "uuid": "0253361c-fd86-451c-a8c2-812ed818a16c", "comment": "Malware payload (Smoke Loader)", "value": "04ecd424d7241651b7616cbf30dcb02d9f453ee8da62a44c20c3d4599dd96126", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694077, "uuid": "5c06e900-c6b9-4eb9-976b-e0778f7efb1b", "comment": "Malware payload (Smoke Loader)", "value": "033c222a464c4161548afc3b16495d594e3ebc2e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694077, "uuid": "f334bb54-d572-4636-9e41-dd018c9639c3", "comment": "Malware payload (Smoke Loader)", "value": "96e3b7e2278002df54f7b53b04c047b0e20ee91915a893be01b55e3b72548d7bb844a2b6578734abd19ecd8c894e0238", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694077, "uuid": "a5466c27-5b97-40de-9584-d61a829fec08", "value": "T169549E407BA0D03CE5B715F87A7997A8692A7DF15B2051CB32C63AEE56346E0ECB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694077, "uuid": "6841603a-6093-43d7-8551-3c7af0dfff54", "value": "31aa62a1475f16bb34b4e4697da0deed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694077, "uuid": "b3ef650a-a2d8-4f72-acf8-3467b001fddb", "value": "3072:Tc7D/9KQCyRXrj0flHKR55HwpKO7mRWwKBmGi36LNeqOqPGgw71wrQfxNaP+/PkC:TWpXrjqlHKR2KO7mM/mGiBfgwpJpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694077, "uuid": "90dd1b01-5b09-4dd3-ac93-0d104595c736", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694077, "uuid": "8eeae627-62d0-4ee7-a5d5-5d24d5d5d511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694077, "uuid": "8494f06a-1516-4a0b-8371-edcb55d099b7", "value": "ffbfb88c129bf711d84fcd56677322f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e34f397-c316-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650726218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650726218, "uuid": "f242075f-3459-4455-8233-ea40dcf95764", "comment": "Malware payload (Heodo)", "value": "428cdbf6b39d64ac0688dd647d426d39", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650726218, "uuid": "24bc1738-d717-4f94-8b6e-0f9b5408ba07", "comment": "Malware payload (Heodo)", "value": "04f877cea3f1462bde9ebfd5b4c5a42b9cba5dbf3e8b0651a40d8eae1c3e5177", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650726218, "uuid": "41252b42-d3f2-4d0f-bdfa-df3c13799339", "comment": "Malware payload (Heodo)", "value": "16807112cb359542cc5b580a94b2f78be15ca9c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650726218, "uuid": "4f85e54a-db1d-4562-ade3-330230da9cf8", "comment": "Malware payload (Heodo)", "value": "ccdf3697c853414c3f8005d2e4d642d6c157d30450fa510154dc13754499c583df8ea8259f66ebbcd4724dee2c589ba7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650726218, "uuid": "492552a9-024b-4bba-871e-a6522c19f726", "value": "T19C348D3132C6C07BD1EB16725716C26AA2F67AB085F9C586DFD41F09EE35542C33928E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650726218, "uuid": "d8bf313b-a3a0-4dae-bc96-c3c81babd87c", "value": "6144:buZlJOFmzvtg1Eyid5GX5BVhthqnhdDpJ+4:bGptged525pthqnhd+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650726218, "uuid": "e90eec2b-95b2-4195-99fd-957e9e8e83c6", "value": 247783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650726218, "uuid": "c1705023-fbc9-4d11-94d5-82b3b63acd8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650726218, "uuid": "7c5e59ba-aeef-4f10-abbb-13878467a44f", "value": "emotet_exe_e5_04f877cea3f1462bde9ebfd5b4c5a42b9cba5dbf3e8b0651a40d8eae1c3e5177_2022-04-23__150333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce324d4e-c322-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650731479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650731479, "uuid": "44299b0c-fd92-4192-8caf-4225463df600", "comment": "Malware payload", "value": "71ba14dc8782e1c219a5947f4013019f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650731479, "uuid": "c69c72f6-c2ac-41d6-b2f8-c9c8767738dd", "comment": "Malware payload", "value": "050d2aa5095810bbc44ac688cd9327db0c48de988f9ec945a8d657199f2826b3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650731479, "uuid": "ecd13449-16bb-4f68-85a5-ea4ae67d3dda", "comment": "Malware payload", "value": "09ec7d4dbdb497b8bf24263fd4e26a724785947a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650731479, "uuid": "34c09d00-4cce-4966-ace4-9f05185df904", "comment": "Malware payload", "value": "a31886fc074fc74bedf16e6e003759e915509bfb8f2befa6bc73895f92c65f602014ebc08afe0cc09d5e82378341dca5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650731479, "uuid": "df3bcda3-939a-451b-a681-36b9cdffb80a", "value": "T1FE62B00A14E4C8C98D1568679491AD9A0FDDDE4FAC4F92393869B9E7E81D4BF00B2DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650731479, "uuid": "6fe677c3-2e00-414b-bace-c4553367e5e1", "value": "384:VqGLCd4Iz7fIsCIEWXTHBax5+RNBgRQ9TJYnMHorfQBskhRs6sTye:VXCPz7f1CoYioR6FIGsSRs68ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650731479, "uuid": "45b23b14-f69d-46f1-a7b5-426806b0d881", "value": 15709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650731479, "uuid": "83482911-bda7-44dd-bc00-1784e7e52b68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650731479, "uuid": "e45998e8-7a9a-4ac7-a204-dc30f07f0e5a", "value": "2DGW Wire Transfer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae6ff6-c2cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650694236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694236, "uuid": "9e8e475d-ff99-4940-af37-d1dbf52e30d6", "comment": "Malware payload (Mirai)", "value": "a377f168325c97a6d73018d06c9eeb68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694236, "uuid": "c7dcc662-69dd-4ef5-a43a-65b927a1cc6f", "comment": "Malware payload (Mirai)", "value": "05684c7a6f2304a6272e72c2fd6285967b81d3928946307a97a7ec4c2de7ec89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694236, "uuid": "6fe6c99d-30dd-415e-ac54-08df4ccdc6ec", "comment": "Malware payload (Mirai)", "value": "a39c32d02783ea257bb8c5beb52884e1cf9d3a21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694236, "uuid": "38915934-42c7-45b1-8788-366bbcfbc176", "comment": "Malware payload (Mirai)", "value": "f453c26acc0b21b9f9afec4a02d20b274802256f08fe31ad18198688d6bed31b56b56acf88adda31a798ce8abb4151ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694236, "uuid": "06e72c80-2acf-4436-949a-97f5231182ea", "value": "T1E1F2E19F2D717E98DA6C1CFCC96A132218C5A095712F6BEED354C8C06F63A07B80F069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694236, "uuid": "9a84aae6-7f94-48e1-9be0-d9cdee73e867", "value": "768:AFwpd/7sOXawHXrH7Iu1hivS3Vu4WUtPaUsvrssSQbXxJWMu:DQOXFHbHcu1hivQu5UsvrssSuX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694236, "uuid": "57ab78d2-7089-4f58-bead-fbfdcc5161ec", "value": 36312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694236, "uuid": "7ffcd269-6478-4ef3-b798-1f14211417e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694236, "uuid": "457ac49e-b130-47f3-bfd0-1723684b9f5e", "value": "a377f168325c97a6d73018d06c9eeb68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a55d7e-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650680764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680764, "uuid": "9e8ec375-fb92-401b-b63e-12869d273e5b", "comment": "Malware payload (Mirai)", "value": "ef3babb740b4ceccd757d1a2394b0a9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680764, "uuid": "d92e13f6-2c44-406d-ab8c-dcb4092c0c88", "comment": "Malware payload (Mirai)", "value": "06c39d9ced890b14b9fc56b47d3d8b951435dc74f611da19186b8b6e663633ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680764, "uuid": "81c2e1ce-6724-4596-ba32-5db4778ea074", "comment": "Malware payload (Mirai)", "value": "6e8a4ee6371dcff380cd1a539f9a3c51f84979cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680764, "uuid": "5c105271-3216-4cbd-aca8-177a2233b95f", "comment": "Malware payload (Mirai)", "value": "839f0fe6f7756b477f4770725f4f501c5bdc138da8616940728d6be7d126762f7753cad6e7293914dc86823a57d4dcc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680764, "uuid": "790f1f87-f8bf-4eb7-bfb9-90e2fc075fc9", "value": "T165E2F1B1633DD9D0C9641437CC660C03165AEEFC52FAB0962E68CA1C36F55CA65FAA83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680764, "uuid": "ec6054ad-ab1f-449e-87fb-4dfb5d2b80ca", "value": "768:4/2iW4P+Ej1jMPcmaK5X43WJdY2y3Rd9q3UELDx:wS4WES7w3WJdYpmLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680764, "uuid": "86845a7c-609f-414c-9259-26c0bae37fb7", "value": 31952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680764, "uuid": "9fa4c138-1875-4758-9907-9ae225f10064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680764, "uuid": "a0d5dcb2-885f-4700-a329-1ca336903271", "value": "ef3babb740b4ceccd757d1a2394b0a9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b58fc0-c2d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hive)", "timestamp": 1650698687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650698687, "uuid": "70ebb60d-e8e0-41e3-8ce5-3a2af8b5a8eb", "comment": "Malware payload (Hive)", "value": "37130df0dc6057afaf677c2907eebdb4", "object_relation": "md5", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650698687, "uuid": "add0b8dc-0cda-4d48-a0a4-84b243f20c01", "comment": "Malware payload (Hive)", "value": "08c11a4d6f275b0a5b57871c8d02097ec77019215ef66fb4e73dc7c29cf6833c", "object_relation": "sha256", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650698687, "uuid": "ed3c7acc-1914-4008-a625-feda94414318", "comment": "Malware payload (Hive)", "value": "75caff36d1115049d605f91a651bf0f8479118cc", "object_relation": "sha1", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650698687, "uuid": "7c81efa9-464a-4f40-8408-7668cc4ffb4d", "comment": "Malware payload (Hive)", "value": "6f7e1268be67fe9a698d148a1b8c488ab1b0325de24a7a959bada6a0c6e2691d71132430f96aa3858895a05498392f85", "object_relation": "sha3-384", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650698687, "uuid": "03bf1785-3dc6-4b5d-9489-c0f138a68638", "value": "T19B163803F89594E9C4AFD174CA6692527E717898133063D33B50AAFE2B73BE46E79310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650698687, "uuid": "78f843eb-53bf-4627-893a-f2f8206b7f1d", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650698687, "uuid": "29a23ef9-11db-4292-bb95-344d06be8864", "value": "49152:WYS35HobXrb/TavO90dL3BmAFd4A64nsfJoJLNXdCVpo/MFKQm8cjdFiMLz4zy4y:WYCobCJZ0S5Qmxvl4fEwe8xj/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650698687, "uuid": "ad8e8dd1-1a7e-447b-98b6-ce70c4456f35", "value": 4041728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650698687, "uuid": "8c3de78a-9649-4e4d-93f1-1b5e5af4db2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650698687, "uuid": "235a4fe9-bbd5-4b70-847f-f4fe58fd5ee8", "value": "exec_ap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bd18b9-c311-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650724063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724063, "uuid": "e882c7db-bb46-44e8-a637-75c9f2d67ba2", "comment": "Malware payload (Heodo)", "value": "c9f68be042979eff65cffdaefa1cd530", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724063, "uuid": "20fea48c-8783-40cd-9cb0-80b8d6a89ea1", "comment": "Malware payload (Heodo)", "value": "0b6c18d9c93ae533a7d3463e1868c5e370421983f353fe5d42d0be8e2263669f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724063, "uuid": "684f88af-5c23-418b-9411-4f0e0bcd8d1f", "comment": "Malware payload (Heodo)", "value": "8c8cf6dfebde47912fa12f44a9550639bad9473f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724063, "uuid": "e819eb53-f92a-4c83-97be-b196807898c8", "comment": "Malware payload (Heodo)", "value": "8ad6168b16954dd5dcbc7f5b1630fa922bea4025c6daf7167cfd9a2eaa667c174e47d09d1775a3c89da08ea002b7abc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724063, "uuid": "3bb44e90-a178-4a69-b2fc-e0bcd9df46b0", "value": "T15C247C41B293817BD6B225701F951B3BABF9EE1007A1BEC787E1CC1529335D36A3A706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724063, "uuid": "f4b7d0d6-0d3a-4127-a14f-ecca37cff87f", "value": "3072:NEwdYe6ZqtE4EWsGD3MmL17ZKokiIqLHAvgmzFV1Tu:NEHZqt2fGTf17ZWi4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650724063, "uuid": "7a01ba50-b1bd-4d00-bfe9-e0342d429ea5", "value": 213720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650724063, "uuid": "7d6d78c0-75e1-4772-ad0a-92f5db61da89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724063, "uuid": "84888110-bedb-4afc-9238-a2f7ed376d50", "value": "emotet_exe_e5_0b6c18d9c93ae533a7d3463e1868c5e370421983f353fe5d42d0be8e2263669f_2022-04-23__142739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee795f5d-c354-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650753008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753008, "uuid": "a2bcc947-ced7-4051-88cb-1e92151772b8", "comment": "Malware payload", "value": "9b1c764f5da1e5b8963831b10b0d55e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753008, "uuid": "1480abab-6d88-4f6e-bb77-43cf5088cba1", "comment": "Malware payload", "value": "0cffbd0a9a71d6dc4ccb63dbbfeef735b2c8bf9acdf1409f1cbdeed36ce0faf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753008, "uuid": "865c95b6-1afb-41d0-aef4-64b00e00c7a1", "comment": "Malware payload", "value": "921e7361981d66a38718f9e61da7ed256eb82594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753008, "uuid": "b0796c14-17cf-458b-949e-4cfcd43e93d5", "comment": "Malware payload", "value": "ac009e93dfc734f90fe780d963f91bc0653ab8709f47da46fcc00484e0b9f4cba3083d7e2c6d0e2737ee5062d120b833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753008, "uuid": "e6a96c85-24e7-4a3a-b929-003a6c40e430", "value": "T1B37723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753008, "uuid": "04e53274-d537-4f79-a76a-d4facdd9f7c1", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753008, "uuid": "a22c623c-3a10-4f21-b3c5-25fd8bdab67b", "value": "393216:9ADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8y:9AwwU8SAwwU8SAwwU8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753008, "uuid": "07241fef-e4b5-4afd-a68f-1cfbb7493a1a", "value": 35782076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753008, "uuid": "28d8559f-444e-4bc4-b8d2-44f61e65e0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753008, "uuid": "2815aedc-dc5b-4614-8cea-33aedb010434", "value": "windows11-setup_11_59931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafb8d27-c359-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650755123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755123, "uuid": "9f1a46aa-dc32-4f75-a344-b5f9f4efc971", "comment": "Malware payload (Gafgyt)", "value": "67b8d631c7e925bd127ef1b97d85891d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755123, "uuid": "d7e11358-9132-4e01-a450-699d76c112ad", "comment": "Malware payload (Gafgyt)", "value": "0df4a729c94cb4a8358c92303b14db880ef9a5ae01ebec3962a578d07fb11bb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755123, "uuid": "d4f83264-b2a3-480a-bee6-82647e9bd2c1", "comment": "Malware payload (Gafgyt)", "value": "ceb2241a22a6bdf36216f0325aaa92c6d707798f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755123, "uuid": "e38dbf82-d84c-40d9-a961-913a797f152a", "comment": "Malware payload (Gafgyt)", "value": "c394fed17fec63e764099aaa8c2f912d8ad8048206b838832c37f80eb4910780c3ea20fa8622dc3576cfa82adccbec7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755123, "uuid": "e12a34f1-348d-4917-8135-b060a14d0cc9", "value": "T16FA33A377B130E23C0CA947111E31731BBB5D2DA39FA5243B9A16DE86F266843562FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755123, "uuid": "e1d84cff-1bc5-44b9-abb7-5952fa661d51", "value": "1536:XBJ2MNM5oqtkUtnzphaK6igkvmQmF6OXj6ufeuTe:KMN8vFphaK62vmQmF6OXGufhTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650755123, "uuid": "009d7bab-6226-45ec-8e96-5f155ef3a966", "value": 101398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650755123, "uuid": "34baa419-89e9-4792-a87b-aac50ba4390d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755123, "uuid": "34b75270-a404-4869-9b1a-5ecd4a6d4c23", "value": "67b8d631c7e925bd127ef1b97d85891d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013f0f70-c2a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650677448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677448, "uuid": "1a6da020-a9f0-4a18-b189-b243287cda65", "comment": "Malware payload (Heodo)", "value": "d9ea5cc755cce622d17aed38a384ac75", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677448, "uuid": "dead7375-fcce-4362-8cd7-4a99741dd769", "comment": "Malware payload (Heodo)", "value": "0ea1e315b812c515060fb0c9931fb1bbac67878cf77b1c63b6409429ba0400c7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677448, "uuid": "c70af5b3-4071-452d-9e87-a61841acdcd0", "comment": "Malware payload (Heodo)", "value": "b1dda5cf21efc633ff37e7674b703513c176d4ab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677448, "uuid": "34f3315a-a0c5-423b-85fc-46fc929bfd12", "comment": "Malware payload (Heodo)", "value": "60afca0f32764cb06540abed083d43a1980288a8c6f35df5c538967dae4c2d9204818d86df2fdda6e620c2d0f1e672cd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677448, "uuid": "2297f993-e814-4125-91d0-b8fbd32bc6a0", "value": "T19DD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677448, "uuid": "06e25c00-3fe6-4906-a21f-7c572b664ac8", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677448, "uuid": "a36b65bb-8ba2-4f0e-af6c-47328c5ce195", "value": "12288:C1FIcocJwMTHzXO7N2aBHiyzskF1CubVnmn:tco9MTHzXO7NT/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650677448, "uuid": "324d6d67-b93b-4fd8-ab4d-de51311b5497", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650677448, "uuid": "95ed9afe-6575-46fc-bcdf-fdb863cd5d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677448, "uuid": "92aa82bd-154c-4616-b79e-68968cfdcd88", "value": "d9ea5cc755cce622d17aed38a384ac75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75319d5b-c2c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650692675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692675, "uuid": "bea4435a-6dcd-45ad-a47d-facc3be2221f", "comment": "Malware payload (SnakeKeylogger)", "value": "005ca4c3e4d4ba09470cd76dcec47efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692675, "uuid": "ace2d52c-835a-4886-8ae2-415dba84a51f", "comment": "Malware payload (SnakeKeylogger)", "value": "0f74becfe191c507b05f0bc7a35af642f7684e0ac05576b012a064d9ca16435a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692675, "uuid": "66c6c75e-01e7-48c1-af5f-55741ec5054d", "comment": "Malware payload (SnakeKeylogger)", "value": "210d10bd7d0184180cb5b452aac272527470ded5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692675, "uuid": "c86e99b7-6c78-4d2d-9b7a-f24f4378c602", "comment": "Malware payload (SnakeKeylogger)", "value": "41f3e6c41cfec0ad824a74f325f1a12782fae390654a723064599620294f84a1cb539f70befd1b535199c5ba41caa6be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692675, "uuid": "cc96805c-e7fe-418a-8f51-3e450a9f37d6", "value": "T1E6A45BD8355071DFC457D932D9A9DCB0BA9034AA430FA34BB0538AA9AE9D4D7CF102F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692675, "uuid": "2e81dd72-2545-4e17-b5ef-212557b4ab0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692675, "uuid": "0cc6c775-884b-4816-ba1c-ccff551ad3b3", "value": "6144:UuidXhc232gONhIp7F/dgqjiKSTWaG6MTyDL9MlFp81J0t7jQREnoUiXZrPZ0j:qcLgONhItgxoE9Mi1Jg7jQREnotJrxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650692675, "uuid": "e846a920-5097-4eef-b8d5-695873c7e144", "value": 458272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650692675, "uuid": "6d9c16b7-36c4-44f3-bed0-115f9bb6eed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692675, "uuid": "79dea4d7-485b-49ce-a81f-9cd71b6c26d9", "value": "005ca4c3e4d4ba09470cd76dcec47efb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b977c1fa-c2e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650704816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650704816, "uuid": "d878887e-066d-4db8-bb1d-750ae4f80168", "comment": "Malware payload (DCRat)", "value": "bf4d1cf634eba8c8986e233e09d521b5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650704816, "uuid": "2ada320e-aea9-4bbf-b6c6-2063303f17a0", "comment": "Malware payload (DCRat)", "value": "10b18e742857f69a081e9f30a71d13a7d31559f020ab245bb0db2fe7be73f0af", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650704816, "uuid": "2a93caa7-bb7d-4394-89ca-89814a57319b", "comment": "Malware payload (DCRat)", "value": "3962db5a9903c4644be99fea1a4216162fb4c9f4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650704816, "uuid": "44fc345e-5a79-4226-a6a8-1c1dfc1068e4", "comment": "Malware payload (DCRat)", "value": "8cdc5bf16a57760454c75a79bd639ad87ca6e8726d82f386673fcde29dccf38c8731555e67ed49b2e16d1ea10c551e9c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650704816, "uuid": "4924d4de-1a6e-49f2-831d-a743f1d2421e", "value": "T19B7533AB0FEA846DCF237879D8BC69C7777F938C0D6B45C404560130E6821E9DDBAA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650704816, "uuid": "eb573f27-a66d-4e1c-abfc-9112e9d30d82", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650704816, "uuid": "d2cc02f4-c55b-4503-b724-a90116052278", "value": "49152:QyySwnJJqLtiZnuwa86NEywWd9nyzeDc2AzvrL1mhJ4QC:QRSwnJNfaHE09QSc2ALrL1IJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650704816, "uuid": "51d92ee9-f445-4201-b151-8786275a9ffd", "value": 1618944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650704816, "uuid": "e9893c65-3e82-4d17-98ab-5636bc36898a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650704816, "uuid": "f433fcd6-a7d2-43a0-a6dd-8d330972ddfe", "value": "bf4d1cf634eba8c8986e233e09d521b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b69c6dd-c2cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Matanbuchus)", "timestamp": 1650694779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694779, "uuid": "a6880605-d7f9-4ac1-8727-e301dafa82f3", "comment": "Malware payload (Matanbuchus)", "value": "0aab9a809fce3da2dbf34189ed6d5599", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694779, "uuid": "4d1f17c9-6537-44fa-a6dd-580dbb593aec", "comment": "Malware payload (Matanbuchus)", "value": "10d5483faf9a4e0fbc17556164f47f7014650797b7d501289b269515a0853b64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694779, "uuid": "7f065e79-0021-4197-89d8-def95551313e", "comment": "Malware payload (Matanbuchus)", "value": "df573858027863f0c3291b4be30c35afdb7756bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694779, "uuid": "50cefdd2-8c06-4db2-a671-749b777d16c8", "comment": "Malware payload (Matanbuchus)", "value": "918721837da57c094409ced8c402293bfd3d349ae2c25fc44260b0e11fa5c29e814bd4744d062c0a29b1f95751d53857", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694779, "uuid": "08e82281-61a8-4454-8755-8a7007005a42", "value": "T1F1543911B500F132FCBA04759E749AB04A2E7E309BA805CBBE8C7F2E597F5C1A524E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694779, "uuid": "f22dcf4b-5ee6-4c4a-b233-c7be54540706", "value": "d86e96cd523f0d88359af350afd73632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694779, "uuid": "10e3eb84-1701-4af1-b884-4250e8c31b33", "value": "3072:c6mvqcGPwK96Q5OqyaH1MH/oanIAW+Z7fmq9OhqZWXYWrrRSVMnvw84XWpWeZj6H:mvqPn9BOqvmAarWq7fROnMSkdh4sSCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694779, "uuid": "a653720f-ad6b-4e59-9752-d48d49d7f963", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694779, "uuid": "3e6d14ff-a3b6-40c5-829e-70ebb791a3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694779, "uuid": "0591a24b-d147-4afe-85ac-a0f6ce6810ea", "value": "0aab9a809fce3da2dbf34189ed6d5599.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47e36fe-c355-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650753421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753421, "uuid": "88ddc124-8512-4574-bdd5-fef052fc55fd", "comment": "Malware payload", "value": "1e03c12a2ee524a61f16f36cf50a43dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753421, "uuid": "9d4c897c-d0c0-46f0-a361-df43871ed6e1", "comment": "Malware payload", "value": "1116037d457d9126f16fc9529a4be482d374047f0e834614ae8292a631ed8aaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753421, "uuid": "0aae1c9f-6824-4e12-9582-729dd9cb850e", "comment": "Malware payload", "value": "6e55b8d92640ca05501817f7b2a477e9ab908042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753421, "uuid": "074b9b2f-46bc-4191-a42d-33c9934cad9f", "comment": "Malware payload", "value": "b14558379896f02fa730d5f27175f14c1026cdcdc8a5915a7346a0293346ea598354acb61f75f3dcad38159be146a512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753421, "uuid": "6a0a82a3-09ff-4c68-a3ec-81084011b51d", "value": "T1517723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753421, "uuid": "e3580ed6-79aa-4785-9791-02120b1e5526", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753421, "uuid": "d367513f-9f4e-4c31-8cd2-998f25f370fe", "value": "393216:9ADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw87:9AwwU8SAwwU8SAwwU87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753421, "uuid": "fdf22a04-6327-419e-9626-c94fa5968e1f", "value": 35782076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753421, "uuid": "3aed2abf-1f9b-448f-8be3-697e1ab734d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753421, "uuid": "c63ce7e3-8446-44aa-8b28-98a1e26d353a", "value": "windows11-setup_11_80807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87131b77-c310-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650723629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723629, "uuid": "b7fe59a5-ae4a-422a-9713-baf75368dc6e", "comment": "Malware payload (Heodo)", "value": "9f9ed6e1d902e46f363cf8be7fd28940", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723629, "uuid": "7f25ff2b-84e2-4d7d-a663-858a72a3d297", "comment": "Malware payload (Heodo)", "value": "12ae2f9f8036e282ec4e336c92143cdf32c4bf8e509ba4547c10fba8ca9f820d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723629, "uuid": "43b94caf-0b08-40de-8fd0-a915ec02ead2", "comment": "Malware payload (Heodo)", "value": "0747d95221de6520618d4f5cfdebeb7bcaa30f0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723629, "uuid": "5029dd23-7af4-4ba2-b21e-1ca10a7b9859", "comment": "Malware payload (Heodo)", "value": "9ba2de7662128f8a36e9d012e39a99783b6661c3c3fda6f35b8f5da68219f945aa3add5556e797325b81749a0d14a3d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723629, "uuid": "c79d00f1-059b-4eb2-aee6-4501aaa570b4", "value": "T15CD4B24D7F918F79FC5D017098CC8B7AA995E87B4A904F022ED6EA3ED5FB1424D18C0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723629, "uuid": "43116f50-ebca-45e8-807f-646b1414c667", "value": "e140b4188c69c3bb4852b94813f9ec7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723629, "uuid": "074f199d-494a-48e4-8651-9302dc02ad26", "value": "6144:KfUdJ9dhe5HjGo3OvwX0ddpgqjlfBtAkIeTIpkHMPtdddGLfloHxoB3j:aA9e3OrvpgqjtQFecW6dddifiHxoB3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650723629, "uuid": "90ff2175-8c1c-4dc5-a0a0-e9d601052046", "value": 654864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650723629, "uuid": "86a61627-63cf-4820-8c4e-0390286f1146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723629, "uuid": "90bdd159-cba5-4038-a96f-6835c10514cc", "value": "emotet_exe_e5_12ae2f9f8036e282ec4e336c92143cdf32c4bf8e509ba4547c10fba8ca9f820d_2022-04-23__142024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba0af61-c2ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650695236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695236, "uuid": "f7207117-b771-46bc-987f-71cc902d1094", "comment": "Malware payload (AgentTesla)", "value": "14ce38f88a1104a2c854fa01277abe9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695236, "uuid": "a755ef96-a508-40f0-9bf8-78298427347b", "comment": "Malware payload (AgentTesla)", "value": "145f527b2ed4897854466466ccfb67d5ce075502aca6241821da8e6b67635909", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695236, "uuid": "9e53ca25-9468-4f53-a987-c42fc60209ca", "comment": "Malware payload (AgentTesla)", "value": "cf4c52460e4fea919485b0da047876d5d22ee60a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695236, "uuid": "2962b437-6575-4434-b26f-011b11f70b8b", "comment": "Malware payload (AgentTesla)", "value": "dcebea38915d6c2e4acb26819a95d6de1c401d60700e23f121766ccfd65fb4a521dc9f61959b0061ed0b8b64b35f3da2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695236, "uuid": "7f41e4b8-941b-4be9-9763-1245aa48af8c", "value": "T1FFB48D9C795071CFC447D971CA95DCB4BAA0B4BA470BE38BB0534BEC6E8D896CE006B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695236, "uuid": "ec6941f6-291f-4c60-b177-aac22b7daf80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695236, "uuid": "ab721983-f6c5-45c1-8c96-03e00c088643", "value": "12288:2dMzVPVaXd7E/UEdTd8iws6v2DWwlhiXiXb1/DuY+lQenUCJeu0H39FoJrx:zBNaNMjTdV1DWwlhaMZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650695236, "uuid": "4ccfe30b-30e8-4a61-8bec-dbbe17c648da", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650695236, "uuid": "dfd2ee16-0c5b-49e8-a49e-866501f62bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695236, "uuid": "a8466c58-7544-4e91-b529-84d72477cddf", "value": "14ce38f88a1104a2c854fa01277abe9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c94ba7-c347-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650747351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650747351, "uuid": "bddcc7a0-a5ff-47a3-9133-277127f6afb6", "comment": "Malware payload (RedLineStealer)", "value": "0c76ae86cf415fc460fdc1ab03c188d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650747351, "uuid": "af0b4871-e8c6-4666-b17e-6bb8f2a886c1", "comment": "Malware payload (RedLineStealer)", "value": "166fc895202cb031cba4e9c512b306e72fc1ab046df0fac6222a1724d2029562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650747351, "uuid": "b022b8db-4054-4da6-9dc8-30f30e79e049", "comment": "Malware payload (RedLineStealer)", "value": "5bb8ecbca4d5aad4a4597dd7ceeca45ccbcc8a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650747351, "uuid": "11ec433d-8f2c-4aba-a30e-a9fa94ddadd7", "comment": "Malware payload (RedLineStealer)", "value": "fe16d818534ec4473148fd7d5ed9dce8ce4427ed3222e48f1081f85c1c10c6aaf0ae343a53c55b56e38e28fadabe21b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650747351, "uuid": "07f9b897-4257-4884-8fa4-21e5d30c5ea8", "value": "T16BC511BD7DFC8D4CC940FA37D78661B0A9D02CAFB820A1D2D68175843EBD186868F5D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650747351, "uuid": "ad8c804c-3a90-4853-a420-a1fbc1d174a0", "value": "a2833106949ae6e20c40ed0128f9df4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650747351, "uuid": "447462d9-1980-4ef3-8a89-545d8fbd0773", "value": "49152:0xn99tKqVy1sPJPszZLPYmIeSlymb93EZyR6+i/0+2mVrYWBZKHtb8:0nxKqVssxUzZLT76JR6V/qmAtb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650747351, "uuid": "5f4490c9-6c2d-4025-a79c-89d8516ae94a", "value": 2578352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650747351, "uuid": "da24fbb4-d69b-49c4-b5d0-fe0b00b1ad4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650747351, "uuid": "4ba33ee9-c27e-4336-8be7-5068685d0023", "value": "0c76ae86cf415fc460fdc1ab03c188d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df416889-c328-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650734085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734085, "uuid": "f266575d-8908-4fe2-a1e2-70523d23c410", "comment": "Malware payload", "value": "dd4b6155883fe44a3d9e784bf68a2562", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734085, "uuid": "fdd3862b-23e4-48ba-b829-9275503924cb", "comment": "Malware payload", "value": "182ed12b1c21d7835428fbcad48b903b322473fea17c76c9df526d5a4c0b5bcc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734085, "uuid": "3e06bd4e-8bb7-4e12-962b-efe7fb82a43b", "comment": "Malware payload", "value": "995c196ab002e98bc9f98ddfbc255168ce47b4f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734085, "uuid": "01463fc0-9a4a-418e-9eb9-a5c448f17b3e", "comment": "Malware payload", "value": "55d77a399270b479f35ec6919d60b8cdf50a18bc566a9ab7b67516c6ca23f3fa308d7372ab0a05de853ceed146b1aaba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734085, "uuid": "a184f46a-7c67-4ca6-a63d-5e8ccea6bb48", "value": "T174C1744561F160544A5336F9683FA2A4F276441B648D9C43B88CC188FFE8E2DCDF2ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734085, "uuid": "7d21e448-0856-403e-9c0e-5016f91a74c7", "value": "96:ugVGqt8RWsd/LXOVyv46kA2m+gWJqY1c6qRTu9R+uReIebwPWy82VA2VI2VkVtvd:NVGqSRxbOVyvAA2m9WJqr6qR6T3dPWFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734085, "uuid": "4988edd6-8144-4ffe-ad9a-bacce5c7576f", "value": 5736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734085, "uuid": "e79df48b-0e48-4f4f-91d1-8369533e2b67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734085, "uuid": "36f9527c-b366-4934-9a63-e1f2b569723a", "value": "deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fdd3f4-c357-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650754205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754205, "uuid": "04f2a413-1ee2-429d-b7fb-ff256fd47f6e", "comment": "Malware payload (Mirai)", "value": "dd06c3bd249549cef01ac073c914d629", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754205, "uuid": "e4d46636-0cfd-426a-ab77-89e7640984ae", "comment": "Malware payload (Mirai)", "value": "1a0766f25a61ca4613a7030755eaa4505957e43e2cc2808514e61e14977c99a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754205, "uuid": "a9d7ff0b-c4ed-471c-9bab-19d1d8ff159a", "comment": "Malware payload (Mirai)", "value": "5db53ff5108563fe4a14c82549e6162d839160c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754205, "uuid": "a1a89009-842f-4c5b-b97e-72cefc3a8844", "comment": "Malware payload (Mirai)", "value": "c80dd02fc37a2775d7ebc698a1906e69bfe7ae0bfc4fa32bcd39fbe2e17dd801de2b89d489dc86e8b3d296d0f0514627", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754205, "uuid": "8ea79f73-7618-45eb-9513-0a9b7a7f86b1", "value": "T174D34B46EB418B03C4D5177ABAAF42893323A754E3DB73068D186FB43F86B9E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754205, "uuid": "01ed46ad-2a08-4315-a6ad-e959dbd163e9", "value": "3072:99RP//oBNo6gj7WYanPT+wvIkXMBXqNUJCNSGrr3rgM/9JeovH1Eyh:9bPHoBNohjCYqHDXMBXqNYCN/r3MM/9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650754205, "uuid": "8c40d4c4-9276-4b50-b777-e719bebce43a", "value": 142574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650754205, "uuid": "3a38d98d-b8bf-4aa3-b9ed-9a6d94709a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754205, "uuid": "08b7c92e-45f2-4894-bf8c-baf01917044c", "value": "arm7-20220423-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32691d1-c30d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650722414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722414, "uuid": "af402182-af0e-491a-8af1-be17f0fcf4fb", "comment": "Malware payload (Heodo)", "value": "c8bb267e76c88477350f80b55936b841", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722414, "uuid": "6ffbc99d-6683-4440-a6e6-42673ca2f699", "comment": "Malware payload (Heodo)", "value": "1a8d8529004a937370b6edcd0ee9ff2f7352ffa8fac1daa7b3f825f076390cd5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722414, "uuid": "7b85be41-0748-41f7-91dd-65003a38f1a7", "comment": "Malware payload (Heodo)", "value": "1e42c77c19b0f8a8fd9ecc9d2663489737605c2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722414, "uuid": "9370fe2e-12fc-4673-8ab1-58ff1e7c1301", "comment": "Malware payload (Heodo)", "value": "73b991a5b6c1868aaef47ddc05098aee17f268f21a324a0ada40bc07cc1fd6a2acb2a0b07d6b9397077b19d2839ea167", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722414, "uuid": "eac84e55-c591-468b-b55a-0998cb99dcb2", "value": "T19D747C41F592C07BC5AA11302A955B7AABF5ED500BA1FDC3E7E1CE1E6D331C26A3A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722414, "uuid": "5cfe8fe5-5860-4183-ab7c-0f9030ff0bcb", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722414, "uuid": "7e61304e-c0f6-456f-a419-9b2e5b24a1e5", "value": "3072:NEwdYe6ZqtE4EWsGD3MmL17ZKokiIqLHAvgmzFV1TH+O4OVhN2Zs9JqlEvQM0Lty:NEHZqt2fGTf17ZWi4QWVhvqlEvQPJuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650722414, "uuid": "59b80424-fa83-44a6-bd83-d8f91189d031", "value": 351112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650722414, "uuid": "2051f0a3-d3cb-41cd-a244-1947f04c1454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722414, "uuid": "cb8d3698-9da1-41b0-abba-30687289f118", "value": "emotet_exe_e5_1a8d8529004a937370b6edcd0ee9ff2f7352ffa8fac1daa7b3f825f076390cd5_2022-04-23__140008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f27f5eb-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650693524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693524, "uuid": "01d0c677-7daf-4485-9534-0b77e589a5b2", "comment": "Malware payload", "value": "8af1576a670919fc3e9b123f3355726e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693524, "uuid": "4c763cbf-adac-48cf-81ed-8e07fed17317", "comment": "Malware payload", "value": "1d41be0b95b2973546565abc63947db746ee2c7e2339b2a95ba4bc17d3b93ebc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693524, "uuid": "c2f14b96-9380-478b-bdf4-45b473b50d2e", "comment": "Malware payload", "value": "e71c4063c01ed1aadddaf671e49195c73ddacacc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693524, "uuid": "4e7643f5-518f-42e6-8475-a62d8e114611", "comment": "Malware payload", "value": "932d2074dfacab818ae9866e728b93a9d29eacb46420dca5a299863dc439e1e5c501ddc49e659f43c1c632b2e0fb5135", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693524, "uuid": "843f8b04-89ce-4298-8106-1d2a04be87db", "value": "T18C21250607F51755D3364E355C3FF340D721B4269D2BDB2D4484DB886CB1908F539A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693524, "uuid": "95580bb2-ed09-4ee9-b67b-17ff82c8c402", "value": "24:8NUvCXdreJ8lTyAJex+/ClH9Oo0aMZDUZrWBpAXD/zusmv:8NV5eJ8lt4Ll8oIBqXjzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693524, "uuid": "d68b1626-2b60-4ea4-9411-15b15f411772", "value": 1195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693524, "uuid": "e48c9373-dabc-47e9-83a7-be5fa3495981", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693524, "uuid": "7305f23f-e756-4e57-91eb-d1b592c5d557", "value": "documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c721b4-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650693349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693349, "uuid": "41d21b9a-1c98-4978-9d61-dc101e06d516", "comment": "Malware payload", "value": "12707913f0da4c8a847723d3f46ad036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693349, "uuid": "05f56f11-efd5-4d76-afdb-8954ff1331ca", "comment": "Malware payload", "value": "1db1e381e5ddd54ed39bf30183b77f38686d127fbc42fafa706cf3527f64654f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693349, "uuid": "61b73c34-f358-493f-97bb-0d78055c989a", "comment": "Malware payload", "value": "2564053aae90a5c1eb28429df7a7a6bbed69e45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693349, "uuid": "161d71ad-194e-483b-b056-8938b1648b4b", "comment": "Malware payload", "value": "6ef587a8a889bbca2c879febb02c670a99cdbb778f48e94d0bcf8d9c9551bba62b8f18841ee404fb2233a743917a9edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693349, "uuid": "f1d5ae3a-55c2-4e66-8e32-83417a34f3fd", "value": "T13D1612FE72443358C006CC349123FD48A2B6551E1BE995B9BDDF7A803F6E8549A2AF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693349, "uuid": "57582cf4-6f24-451f-bcbd-d400eb483e0d", "value": "3a7f73b06c8f2c140f105c17406271d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693349, "uuid": "79320faf-461b-4eba-8963-b981d395534d", "value": "98304:hModZkfXH1IqHFhSx1aUvHmoNR3xvFn396:hBk/H1Jlkx1a6Goh9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693349, "uuid": "7bb04c48-bb8d-4c43-bade-82130632d207", "value": 4032512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693349, "uuid": "a006b7a2-6b8a-46af-85d7-e495de617bcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693349, "uuid": "01b87594-c2af-4677-9bc1-6b17e686da76", "value": "12707913f0da4c8a847723d3f46ad036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d632b4-c355-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650753453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753453, "uuid": "36ae8924-df90-46ee-87d6-bf3309365df0", "comment": "Malware payload", "value": "1cb842f25cdacd4e0e0f07b06cdde38f", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753453, "uuid": "6697a83c-366f-4c75-9819-53f036678af6", "comment": "Malware payload", "value": "1e6fd1d04d8ab5dfb688e17b15c28f217ea649afe77c4e7f7e4acae24dd80f26", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753453, "uuid": "2288a131-4418-48b5-aeaf-722eda3ac53e", "comment": "Malware payload", "value": "f0b074a98dc1cf57a845d7ec47e8a74396b8e1ef", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753453, "uuid": "ebfcb8c5-d8c5-4688-b6f3-eb0056f931c1", "comment": "Malware payload", "value": "bf3532a178e26db97a05e41aa59ba414095f84ddbcbc7b8c8ca2a8896739f17abd51b1c57f7601646ad50f8945bcf433", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753453, "uuid": "5b37412f-ddb2-4b37-82f8-721cb146d953", "value": "T14F7723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753453, "uuid": "6e21e153-8317-4084-baa7-45122d1788c7", "value": "393216:rADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8M:rAwwU8SAwwU8SAwwU8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753453, "uuid": "448ae0bf-b259-4b03-afe6-0d67779ad38e", "value": 35821568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753453, "uuid": "b965f1ac-637f-4ef5-b490-5adb573e7126", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753453, "uuid": "bb54ecff-0aa8-4714-b3e8-5a1927ba5e76", "value": "Windows11-setup_11.13336.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffc694a-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "183882ec-ccce-42f3-9638-6bd7302dadab", "comment": "Malware payload (Heodo)", "value": "255572678348b9d1001b01b14236236b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "22253f00-16fc-4838-bb2f-09fd1ef1126e", "comment": "Malware payload (Heodo)", "value": "1f1a926bef9e0054f67ceae3bcf8c022de62d230dc8e9041dfc8619e4a6bb2a2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "17fb42db-9939-458d-b06a-0dcc8eb6cf32", "comment": "Malware payload (Heodo)", "value": "c99df99a0c6cf78661fd7348bc081c012e954499", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "0903a3a6-16b8-4dae-a610-3ad17f782511", "comment": "Malware payload (Heodo)", "value": "fe7dea85d382076a18abf3459b900039a632028e56d3348b7143317ea040f815800e4520e86471f8bda08c1eb24ab977", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "b68635e8-2e93-4d44-bd47-c92ca04c7be5", "value": "T11ED49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "8be64469-95ff-4c23-9007-af5807ae051f", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "9e9f84f8-98ec-4947-885d-f87e0e24f2ff", "value": "12288:C1FIcocJwMTHzXO7N2zBHiyzskF1CubVnmn:tco9MTHzXO7Ny/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672104, "uuid": "13858dc5-7279-4e1e-9233-70cee6f0d3dc", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672104, "uuid": "26d4a8a4-7e50-4446-9249-cd7b68d4a1e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "f8c337f9-57fe-4d66-b59a-0d5f65e9306e", "value": "emotet_exe_e4_1f1a926bef9e0054f67ceae3bcf8c022de62d230dc8e9041dfc8619e4a6bb2a2_2022-04-23__000138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdf7212-c2fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650714967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650714967, "uuid": "6753cd51-b528-429f-aa23-4e790feb0b87", "comment": "Malware payload (AgentTesla)", "value": "aef17dbedf34f6946a91c214b1df874a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650714967, "uuid": "a6decfdf-c37b-40c9-9e39-457641b5dccc", "comment": "Malware payload (AgentTesla)", "value": "23ef0e7820649e02ac2d95cb4754394ce45e167e5abe1940beeb5d8da1a640d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650714967, "uuid": "3c6a5707-2a2f-4406-93b1-760b2b0f25b0", "comment": "Malware payload (AgentTesla)", "value": "7402b36b7352bb54a539eaced1bf2d12cea32167", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650714967, "uuid": "d15e9dac-498c-44a6-a45d-691e19784e2f", "comment": "Malware payload (AgentTesla)", "value": "c7267b6829ba50ff30f0daa4fc6d1c7660cfd6c981b5e165062e8420c60014308b73657f7edeef9dc7e67a25c174df7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650714967, "uuid": "b863dd6e-dfd0-46de-b657-74e42c82885b", "value": "T1A6D49DE28DB0254ED9659B38E0C3CCB0E5DDE158552E778874704B072E9D3C0DEDABAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650714967, "uuid": "aab842aa-bbdd-4098-b482-27a2043031c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650714967, "uuid": "b7b7156f-88de-48ce-bce0-3b5a7549c486", "value": "6144:PR7NEYoiXZrPZ01R1QykR55/DL53fCQxC2EbkvZZaBbenSuqIPA4j6k2GpLPuYMz:PY4Jrx3ykrdLkQUYBZOqn932G1PuYK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650714967, "uuid": "e9081024-125f-44b0-854e-754b5ac6fe1a", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650714967, "uuid": "ddd99b26-0b74-450e-a3f4-9d7773d54fd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650714967, "uuid": "42e6606b-aa77-4751-9238-1fc090e4a427", "value": "REMMITANCE CONFIRMATION REQUEST INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb758584-c2d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650697169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697169, "uuid": "1beec5d6-a153-4156-8f7a-98c15ec8d550", "comment": "Malware payload (Loki)", "value": "ef0bb4e3ccdf561ff2755211861454f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697169, "uuid": "b5a973ef-7661-4378-8212-530630a80bb7", "comment": "Malware payload (Loki)", "value": "253064a458b2827f7104559b04534be6ba0156ef2094fd20fa09545fe05f9564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697169, "uuid": "8054ab99-10b7-4120-b9ae-0cfd4a268250", "comment": "Malware payload (Loki)", "value": "a0daf50c1a63dcf80f87b5aa7deabe34803cc0c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697169, "uuid": "faed20ea-ecdc-4f86-9854-5fa5a10022a4", "comment": "Malware payload (Loki)", "value": "b3a8858104284b31bcdc04259fb3ffdd9db7eab499a7d7b69544f4e437d6c562912a138af2b4bce36c228283f8f75daf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697169, "uuid": "1bbc2298-bb7e-4b6c-97f3-441825a11d11", "value": "T1F1E3F10566F0C4F7D8B306321ABB76276FFFB51605B8060B23116FA97E66782862F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697169, "uuid": "9ef4b665-2c50-4f5d-a857-3c25f2763935", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697169, "uuid": "9a4a2554-901e-4f28-90be-fccf1da22c8d", "value": "3072:l1NjcVVnLpPunbofXbjb5fCZ+IaOddyPgAzXzMBiLnOdcSDBt7kwDn:HNeZma356ZLaoCb1nOdlDBtgwDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650697169, "uuid": "55be52db-8126-4108-af22-2dc8ef8bb997", "value": 153750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650697169, "uuid": "c14a1a37-ed78-4b3c-97cd-2e9c51fbca5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697169, "uuid": "f078ac91-345e-425a-8e2a-f4c02b910f58", "value": "ef0bb4e3ccdf561ff2755211861454f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ed4263-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1650693371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693371, "uuid": "1dbc88c9-9692-46de-b36b-72bf340ccb64", "comment": "Malware payload (Socelars)", "value": "0a84d08ba2e1475a331e7cf9edc68349", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693371, "uuid": "1e3aac51-134a-49dc-b71e-6e6aef529bde", "comment": "Malware payload (Socelars)", "value": "27127befb36ddac5119696e5df4f517aa53835e9556b3706c31908c862a06bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693371, "uuid": "d90c3bbf-780f-4b85-a042-0e9330551704", "comment": "Malware payload (Socelars)", "value": "87154b98683f559b48836873fcb65383c039e7b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693371, "uuid": "f61fad77-34c7-4350-8eac-429e4fb54627", "comment": "Malware payload (Socelars)", "value": "5bd4840eba1fc9ece46ba53a941262bf3eae24a58351e37229cc107e91af750441db301c409f9c8396a98ea3207a7ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693371, "uuid": "015853d0-f400-4670-b19d-1d945600d9a8", "value": "T12865AE11F642A036ECE300B282FF4AFE9D68A621131850D7E3C85D795A719F37A37667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693371, "uuid": "f968fd99-3f05-4dd0-8375-148b4e119a80", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693371, "uuid": "c0bba59d-e29e-4555-9db1-2a8c2dcf90a0", "value": "24576:5QAgpBGV2HpWHuREjDnI2AuADZ8KvqC7uH2dtDPc/sgKFUVvg:3gpG57R8rnDPcEgK2Vvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693371, "uuid": "b1ee0034-c5f7-4147-8d7e-5f34ea736a4d", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693371, "uuid": "18da2c7a-4d5b-407c-8488-d51cf21e5665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693371, "uuid": "b0859f49-559a-4af5-a961-d6f033583146", "value": "0a84d08ba2e1475a331e7cf9edc68349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932a863b-c356-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650753714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753714, "uuid": "be083848-f313-4c25-9e52-3c35e11e3a68", "comment": "Malware payload", "value": "971c4a54d8073fd8b40875a280593b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753714, "uuid": "9a5d5143-d9a7-4406-82f2-3130fb38bfd4", "comment": "Malware payload", "value": "2791dac52edcbf789a926f663f7d8d6d975e3c6d52cf3a75d4307f35319d302a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753714, "uuid": "34308337-af17-4c00-bd9a-c92efc7cfc29", "comment": "Malware payload", "value": "1f30853c03ff03dc555147e0ace1e4a22e9f36e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753714, "uuid": "18fdb4d3-351e-4079-a756-64de377abf62", "comment": "Malware payload", "value": "bb0be44c840c9e4a7d5c295cf34247346bc5e8c2ad0dc9d5b35c7acf20a2a7c520d1523a77d0b93885fea03aee4208e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753714, "uuid": "01cda979-45c6-40d7-a714-99552072e682", "value": "T1967723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753714, "uuid": "8fc2054f-331d-4fb2-80b0-0be304c761ad", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753714, "uuid": "78f51e34-d960-46ef-ae7a-27b4e84dcb03", "value": "393216:9ADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8a:9AwwU8SAwwU8SAwwU8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753714, "uuid": "75ed1e29-941f-4441-83b6-024ec53024ad", "value": 35782076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753714, "uuid": "dd6392a6-3028-495a-9b4d-8531b985a05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753714, "uuid": "5b434cd6-d24d-4d16-9370-829ffce253b8", "value": "windows11-setup_11_17632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd67680-c339-11ec-8e58-42010a9c0032", "comment": "Malware payload (Pony)", "timestamp": 1650741062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741062, "uuid": "96252996-51a8-4f7c-ab5f-17fad94b49f0", "comment": "Malware payload (Pony)", "value": "78fc660b1b04227c15f484fa6d7ccec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741062, "uuid": "fd101582-1ca6-4d82-a80e-c109e7653625", "comment": "Malware payload (Pony)", "value": "280c0b36b6fa306389e7873dadf56eb45437c8a208640ff36d61a3e271c94ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741062, "uuid": "1e9b326c-8cad-45e1-8a79-4d2718a6b5db", "comment": "Malware payload (Pony)", "value": "03f819c02a27cd288cef5271f5641e4202ce8c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741062, "uuid": "a4e62edf-44ca-4cec-a4b7-25acf163deba", "comment": "Malware payload (Pony)", "value": "273d176d0342a92151e5d6ecc0b59d48b135ba3a5a718eb8c71931f15e618e240f89b30cb21d9b8c16b1e4137c5b4cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741062, "uuid": "47f63b0a-bd32-448e-b432-f91a3429ced1", "value": "T1E8F49D22F2905C37D1B31A389D5B57A8AD3EBE102A3899462BF51C4C4F397523D393A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741062, "uuid": "997b961e-83c3-43b4-8b23-6cdd0e4f0a77", "value": "75ba56893d6bafec0e1f2892f1de8884", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741062, "uuid": "678e91ce-3d8c-41dd-8d9f-3db11f66a65d", "value": "12288:BinYMOTCKo5yHzN2DbyV1zDFADvgNIPWjauCFgOvya/Nk5rcwa/Nv:B4oTyQZ2fyV11ADlP6Agk7B/Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650741062, "uuid": "b40d1701-8c66-4656-84bb-ba8e5430fd82", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650741062, "uuid": "def3b687-3910-4caa-a067-b0d9fe50bc78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741062, "uuid": "e3949fcc-09ee-49a8-a07a-e16bdcfe77ff", "value": "280C0B36B6FA306389E7873DADF56EB45437C8A208640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110500ca-c2a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650677475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677475, "uuid": "35a78af5-466d-4245-abd8-e6b0ac575889", "comment": "Malware payload (RedLineStealer)", "value": "176fe60223fc7b05ebb5af06f9addc2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677475, "uuid": "7163a31b-20fd-49ce-82f2-263f42fa73cd", "comment": "Malware payload (RedLineStealer)", "value": "29168ac96b3b4b5726f2c7fda3ef30fcaee9771269d662601ef99213f21a0e90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677475, "uuid": "e1992e12-d880-4aa1-9c94-6f957db44998", "comment": "Malware payload (RedLineStealer)", "value": "1c45f912b794ef1c0e945efdfc8192492188524f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677475, "uuid": "e51bcc34-3bf3-4681-98aa-c00f71b0b26b", "comment": "Malware payload (RedLineStealer)", "value": "a60c9faac44090246e97f9beffc4d9978a693386f1ee512eae264d234d62e1dec97840b1267ec30652f807ed04a6119b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677475, "uuid": "e727dd9c-c2b1-4446-b27e-2807395f9b12", "value": "T1686451036A049B15C97C343A81FB392C63B5F6CB17F0891ECF05BA671DD62A6D9CC64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677475, "uuid": "edbd3686-2d11-4dc8-a266-9df2e6bb7f3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677475, "uuid": "491579cf-3c8c-49ef-8a14-8627ab463a1f", "value": "3072:/0yhNivpwiL+1gmAPEnxvio9c9RBTOXdbcRDQMgG8YY:syax2gcnq5TeUQA8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650677475, "uuid": "f1b45a20-540f-463d-aaac-75941caa3055", "value": 317008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650677475, "uuid": "513a6b7f-3c60-439b-82f9-bf6bf111ad3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677475, "uuid": "5274008c-d785-474e-bc21-d2c2eb5cc2bc", "value": "176fe60223fc7b05ebb5af06f9addc2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c396fc34-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650680781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680781, "uuid": "c15e532e-ca74-4084-86d4-02ec022836e1", "comment": "Malware payload (Mirai)", "value": "722ab9647f487ccf9d62f02751b74176", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680781, "uuid": "cdc62b48-d640-42da-b8f0-0e439d2ceb4f", "comment": "Malware payload (Mirai)", "value": "2a6dfe2c12dc0c358259ae160d4886a5159622cc7c1a26df01868cf81d3b5b66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680781, "uuid": "dac0a5ec-d64f-479c-b648-40568f669d76", "comment": "Malware payload (Mirai)", "value": "08ec842ef802890338e9faec3ebc1fba8394afb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680781, "uuid": "e536683a-46e0-4692-b16b-670c43fe62cf", "comment": "Malware payload (Mirai)", "value": "e26e9bf5210f74a210c7479a3d5fc9b63861ba6526ede02f834e694e9e5f0845500d06b687dd9e356de3fd30c91c31ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680781, "uuid": "072fa436-f9a2-4a82-a4ea-d58b6143fe88", "value": "T137D2E16F5B57A695CEDEBC31904A07B15E8462C33AB66B4A4F464C40B12410EB9DCEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680781, "uuid": "f952e82b-47e8-4f33-b656-adfd2e3f5e88", "value": "768:uVYLMI+v86bUI3ad8L3wbwPu+42yETV1M+JumX5NC/DxHWY:MuMk6YmauL3wbj0M+JRX5gtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680781, "uuid": "4ae1bd27-a52a-4c79-a398-59493f1b312e", "value": 29996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680781, "uuid": "f670021c-b92c-4636-975c-ba8e2822ea48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680781, "uuid": "b037a71b-67be-4b15-81c4-ee9c5e07a706", "value": "722ab9647f487ccf9d62f02751b74176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fc5288-c2bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650688784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650688784, "uuid": "53025102-fd8c-463d-81a8-01b826008f05", "comment": "Malware payload (Mirai)", "value": "3810b6d973a7b2ac31ae48b4415ab26e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650688784, "uuid": "97b23d8f-853f-4d25-859d-6c1334c20ab2", "comment": "Malware payload (Mirai)", "value": "2a7485bd46fc86d5b3001b3d849249445d7cbbdf33f5ce0d5670e8def11a44e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650688784, "uuid": "513b920d-7b9f-4dfc-85c9-eea91e60a93d", "comment": "Malware payload (Mirai)", "value": "5d4245db0f3899f03eb5e1b4adc20ab99bcf333d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650688784, "uuid": "a624c0d4-134f-48b3-92ed-a0a9125dda93", "comment": "Malware payload (Mirai)", "value": "3546868854dc6b072d2896531d3df710b4e2a5d4b8cccb5522f00c6be88fa3eb64098a4d8bba489ecec9990ad90a7391", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650688784, "uuid": "29b185a2-be12-4605-a859-261aa32139ed", "value": "T101B3A44E2F619F3EFFAD823883B75B115205339626E1C585E15CEE021E7034A746FBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650688784, "uuid": "a5ec8e2d-78f4-48b8-845d-7356f2fadeed", "value": "3072:dkYM9FrVhwqP8uAtlEJ0PPiVOUOvQl6gh:6X9Fr0nuslEJ0PPiVOUJ6gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650688784, "uuid": "ea0920f0-d077-4724-96a2-2fa24c1c55b4", "value": 108924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650688784, "uuid": "9e9e5abd-fe70-42ce-b73a-444a6d313844", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650688784, "uuid": "b006e4d2-7290-41fb-bc70-ada4118060f0", "value": "zx.mips-20220423-0439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef98026-c34f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650750862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650750862, "uuid": "e093cbb7-01c6-4c07-999f-a23a30717e7c", "comment": "Malware payload", "value": "47104edb37f9785bd1c150e5bb6a8e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650750862, "uuid": "4d0cdf6d-9ea6-4417-b7c0-ec794db4b7e0", "comment": "Malware payload", "value": "2decd21463b4da4aca846862ce5c77fc74ab89b6fdbcc9eb9727802b992a7a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650750862, "uuid": "8b87ca55-14a8-4c61-b4cf-3fa1c25f956a", "comment": "Malware payload", "value": "575287815b812664a31dd2e3938904f29ac073a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650750862, "uuid": "917b8350-61e5-4190-8132-89cdac5fb1be", "comment": "Malware payload", "value": "71fe8fde90866462063d83464a867e0ae1e27d9ff88214210bfd6b2ba6098d453e580fafbf95ea6722591d2e8cbd3524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650750862, "uuid": "03b2433b-1d7a-45b5-9b61-2db28fff53a1", "value": "T18CC40232F2981CDFC51711FAA854D026267BF71B041DE78629B2B52B69B23C3211BE67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650750862, "uuid": "d904504a-0790-497d-967c-183d76bff5ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650750862, "uuid": "0287a7e6-db65-4292-a1ba-8d0f82d65672", "value": "12288:tsAYtv/hC2iNPgjjKA/yoWmJGJBTeUlDRLXOeAuSEg60ijsZphRjAE2PkzPM:SBdhC19gjj0ScXh+rjEvKZ3R0QzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650750862, "uuid": "993033dc-2efb-4c5a-8e1a-0d5d5ed30aa4", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650750862, "uuid": "81512e39-5842-4e3f-87ad-f1c488be34f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650750862, "uuid": "82b2ac41-e314-4a9b-b385-9bd707b53862", "value": "Product Inquiry.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4521a4d0-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650674556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674556, "uuid": "48b5a74b-5488-4de6-89d1-ab9df84b6d0a", "comment": "Malware payload (Heodo)", "value": "585767c043565a4e2500ccf86ec6ef73", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674556, "uuid": "a4f25cbf-6f83-4a98-b27d-25e8c0c9c068", "comment": "Malware payload (Heodo)", "value": "2fffcbdd5595e18f06ca70d497cb34c163c39ca90c59ad2539a5d9efdccb1a7c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674556, "uuid": "5be8d94a-d5d2-41a7-a8b2-a2bf7f9b128c", "comment": "Malware payload (Heodo)", "value": "eb872ab409d631b56367c0c0ecc45de154968be5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674556, "uuid": "1db85d60-42fc-4e45-aa70-ff35bc1248c5", "comment": "Malware payload (Heodo)", "value": "f92bf4dc528c40aa213d11e7be3f982f083356609c17c0190c224a2b6f5734efe5b7ad70060f282c992378196d492822", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674556, "uuid": "a7b4d2b8-efb4-4152-9d3f-c28bb8d0bcb1", "value": "T1ACD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674556, "uuid": "d5b17485-35ae-46e5-955e-ac673c0c316b", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674556, "uuid": "578af6d3-68f1-455e-ac39-e756bcca6bfb", "value": "12288:C1FIcocJwMTHzXO7N2fBHiyzskF1CubVnmn:tco9MTHzXO7Ny/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674556, "uuid": "97c255a8-3381-4b07-907a-5de19758ed74", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674556, "uuid": "d06b9e77-935a-459a-bf6d-4bf182776b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674556, "uuid": "12a65531-cb85-42fc-88fc-c87e5cfc84be", "value": "585767c043565a4e2500ccf86ec6ef73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1f9f6c-c304-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650718453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650718453, "uuid": "45963512-969a-4ce5-81bf-ba20329f509b", "comment": "Malware payload (Heodo)", "value": "413bcec6dd7aae0800066f0f195a037a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650718453, "uuid": "66617326-42b0-4ba5-b479-e46177310078", "comment": "Malware payload (Heodo)", "value": "31303c246cfef4ce6627692d25f4a233cd589632018e9c32326648cf9a29fbac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650718453, "uuid": "5ce1ea1f-543b-4ce5-b71a-ebb721715ef9", "comment": "Malware payload (Heodo)", "value": "eee5dc05f40d32fb87d2781d662fc66dc41f3a37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650718453, "uuid": "7b8c5e98-317d-4d75-8852-ea9d336f38cb", "comment": "Malware payload (Heodo)", "value": "69d8a7407e2a027f5f9bf9bd91594402977b5c76685bbf104022a3b56a6d2ed7dcaf4f83155d19b7019cc2cc6930c468", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650718453, "uuid": "a0315294-a321-40ce-be07-058768b0f259", "value": "T10A05D06175C2C472C3FA323D4955FF645BFDBDA0463A8247ABD066EA9E30691C634383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650718453, "uuid": "2272f4a4-4ed0-443a-99ce-521282543f86", "value": "12288:Wvz1CLJyyvmMLD397BogNreNmF+U/9JckIAGfUebD+DlYzv:WJCLJyybL9Bo/N6+ADckbebSDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650718453, "uuid": "46d5fa2e-fec6-4254-b129-048eacb7a21f", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650718453, "uuid": "63187730-452c-4169-8482-6340ae409105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650718453, "uuid": "66583d06-a200-4eeb-a749-185c191bb448", "value": "emotet_exe_e5_50a6f4883aba834a2e9cc27966a8c4f495020c4511d9c6899081c046c21b5622_2022-04-23__125407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6843c791-c2b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650684493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684493, "uuid": "647fe7fc-58a8-4723-ad09-b230c33349d0", "comment": "Malware payload (Heodo)", "value": "5e5e8498627f76c40a30dda916eb2d8d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684493, "uuid": "ea73833c-7b38-4af2-86be-acbc9f2e448d", "comment": "Malware payload (Heodo)", "value": "314e2e73917551cc14aae604b7b5966c25b4090fc80498760b69d606ba9b5fdd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684493, "uuid": "7d884cf5-be99-4a48-9509-51a22596a6f3", "comment": "Malware payload (Heodo)", "value": "854d5d51ad9171146c732aafc8ad75cda12522c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684493, "uuid": "f2755219-f4d8-4cff-9c7e-66f2610226ca", "comment": "Malware payload (Heodo)", "value": "09f225bb5013635a9c80a658515fba9eb95165c1715f90fb11452b25052aa58944d5cbc8e899951395fffc08663e76c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684493, "uuid": "45723f6d-f03f-4e86-8df2-65e63732393b", "value": "T1CDE4C63D2FAE4062D8660770145C0FE991ABCE25BB2255FF25842E2E2EB57C74879F0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684493, "uuid": "94b0097b-bb3c-4613-9a0b-022c923a0261", "value": "70b8cfa68ef2c7898ee65b9a0ce218ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684493, "uuid": "c383314e-be72-4972-910e-1af5c6732cff", "value": "6144:iKfJCALkjp1g4SbsLyKilbNUBmB5XORDlsOMAidDNcYs6kzpYmcHWk870zCxSE:iKJCPjp1g4SbBKilbUD4LmQjcQ6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650684493, "uuid": "a1cae238-6f16-4fb4-b2b2-3e911c01663a", "value": 720356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650684493, "uuid": "ea17d839-2f9a-41ff-b2fe-a8410bd30cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684493, "uuid": "bf97e54a-72d2-43bc-886e-d3ae51179775", "value": "emotet_exe_e5_314e2e73917551cc14aae604b7b5966c25b4090fc80498760b69d606ba9b5fdd_2022-04-23__032807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ad19a5-c2ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650708004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708004, "uuid": "4bf25d3a-398c-4653-bb5c-60b8d282960d", "comment": "Malware payload (Mirai)", "value": "578bda760578f146c5a5df6c15198520", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708004, "uuid": "ae5b0747-47da-4df1-b04b-2861aa8cfe98", "comment": "Malware payload (Mirai)", "value": "319f757ac16400dfd65008552b790bb30fbf406fb31fead260ce39af2fc27c99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708004, "uuid": "b6e29e79-2959-498e-832f-367bfb56db83", "comment": "Malware payload (Mirai)", "value": "0f8264722ae60b2af6beb5d919f2d3a0be11bb38", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708004, "uuid": "b1bb02f0-a8b4-4300-91be-3a6d44563ea4", "comment": "Malware payload (Mirai)", "value": "7120c0bd04dfecefbe722be3fcd7d6e42e55dbceca302afa03b66c94b4110eb7e84d740eb1a85c965e3e92083b9883d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708004, "uuid": "0960d5e4-7041-4e0e-937e-8efa8cba2563", "value": "T115D34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708004, "uuid": "5a7e9d3f-1263-4e5e-b9aa-79aad409459c", "value": "3072:BxioDMQI5nrWaO4nt3qZg2IWu6b4MX7LkDM/94PmPw/t93:DioDtI5rdnt3qZgPWjHX74DM/9YmPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650708004, "uuid": "6f2ac7d0-fbd6-43c2-993a-d7af07a0cbe0", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650708004, "uuid": "21d49109-c1cf-4e9c-a6b7-0bd939529d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708004, "uuid": "f63850fe-ba5b-485a-b747-89081d10abfb", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d701b9c4-c356-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650753828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753828, "uuid": "62bf008a-5352-4dee-bb49-3b06f010c733", "comment": "Malware payload (Gafgyt)", "value": "e321b36b91d48cbb3b865e48141a98a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753828, "uuid": "ab2727ad-0cf8-42a9-9838-9dc1f5a1b5b0", "comment": "Malware payload (Gafgyt)", "value": "3393ebd016d931844f5fecfb5dca819778730a1c0c00caa576228eb8b47d9ce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753828, "uuid": "588e0dd0-d5f8-4d8b-b44a-f644d9928d4d", "comment": "Malware payload (Gafgyt)", "value": "3c9de596d9dd3e92db81dd8f49a700ee9c04bab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753828, "uuid": "737901ba-5e0f-4838-bd3c-15c05af89798", "comment": "Malware payload (Gafgyt)", "value": "ce101f0472dc7d9691f893ece836cbce95dd82d77764a3aa3f8ccfd167414625d5a4cb2a10041c32e6f6e016fdd63e54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753828, "uuid": "524420e4-0cf1-405a-aa58-171139ae31dd", "value": "T10D03E037A6D6E433D3B11832C83C816BF7879A2851F3359327E15BA85805E41B9B628B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753828, "uuid": "a924c741-aa10-44df-ae0e-c014f764df1b", "value": "768:SvW5OLovfPUhhEYiFGsRv0wu+306j+lTs3UozHw1/DtydP:L55PY1iFGBw6+zHwptO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753828, "uuid": "b3f63fa9-7fc4-4f14-9e8b-1f73af2de8a6", "value": 38872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753828, "uuid": "ddd9c7ba-1b93-4b49-9343-68223e849a16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753828, "uuid": "4a275348-fd4f-4e6a-bd5b-114bd839125c", "value": "e321b36b91d48cbb3b865e48141a98a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64490b64-c2ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1650695224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695224, "uuid": "3ce8c3e3-106f-4226-b522-7d58c116af64", "comment": "Malware payload (Quakbot)", "value": "f30e15298332b69704f00158315d1ffc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695224, "uuid": "acb612b6-82c8-4f82-ad92-8135868856c2", "comment": "Malware payload (Quakbot)", "value": "3505f6a0a62a46697ce0f4131f0571380462bcae2938cdb553b803d1667bf68b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695224, "uuid": "8c57e005-2249-4871-966e-0fbf154fb5f2", "comment": "Malware payload (Quakbot)", "value": "9537863f989adb95b3a14e5687a56cb5abeb3480", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695224, "uuid": "cd5e8d15-aa0a-4fd3-894b-c48c6accc9b4", "comment": "Malware payload (Quakbot)", "value": "691f66f0f201affb59d78398f6e4493796b93160c1fe8dca90aa6cf85b87245bdfe27571d853222e63c8602396e43fef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695224, "uuid": "3500a7ad-fbc1-4209-8bc8-568b85eb0628", "value": "T193F4AFB875047DD6E5AE467BDD96ACDC13B62773C9CBA5CC80647BC309A3326EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695224, "uuid": "29da636f-d48b-49b2-8215-6bc0263ab009", "value": "1af479bde1363d7983f378908d494d95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695224, "uuid": "c0f549d4-61f0-40dd-b30d-24bcb9e1f560", "value": "12288:b1WOAct8HDgwRanGvLXO/s3kJvOjRir3NtttKvMK3+9Uy4+fXwo53Z824cH:b1KO8jgwRaGvDO03ktOtixtfKvA/fwov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650695224, "uuid": "13af12bb-0632-49ac-92f1-924c078b49a8", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650695224, "uuid": "a138100c-9557-42d1-b918-65a656c47303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695224, "uuid": "bc0d302f-31be-459d-86b3-bd0bb124cce1", "value": "f30e15298332b69704f00158315d1ffc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fd9afb-c2b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650686123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650686123, "uuid": "311a5f15-7181-4980-a948-d8b33e46c2ea", "comment": "Malware payload", "value": "d730764ded98f327c37c8c0171e9c948", "object_relation": "md5", "Tag": [ { "name": "Eagle Monitor Rat Reborn 2022", "colour": "#3ECF21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650686123, "uuid": "cb1f9bea-ef58-4cf8-9080-f4385fe12d93", "comment": "Malware payload", "value": "37e9623ae0c5674dd292c5e8fe35a661180c3642b2f4dbbeecccaea8d62e6db5", "object_relation": "sha256", "Tag": [ { "name": "Eagle Monitor Rat Reborn 2022", "colour": "#3ECF21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650686123, "uuid": "dbc0d8f1-4986-41c4-a29c-4df3aff39e32", "comment": "Malware payload", "value": "0bde33da8503977f89561892aa11603223a451fe", "object_relation": "sha1", "Tag": [ { "name": "Eagle Monitor Rat Reborn 2022", "colour": "#3ECF21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650686123, "uuid": "2821088d-64bd-45ae-b12b-af00bad6e045", "comment": "Malware payload", "value": "0adee3b949c669b5759f3d781274a5afb32e46ccb52f2ffb7efbdd7377d9b285fe2d96cfb3afaf7c0008a1cd2a9309c1", "object_relation": "sha3-384", "Tag": [ { "name": "Eagle Monitor Rat Reborn 2022", "colour": "#3ECF21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650686123, "uuid": "3753e5e2-05c6-42fb-bc36-b5b9e692db31", "value": "T1B1E5AD25FE5C38EBEC0D06B1AC1805FD03A06E8264B8CAA4DC5D728976F574A71FF646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650686123, "uuid": "96e9e14f-4b62-4360-b017-abf1d8828aa9", "value": "49152:I5F9YliZRy5rEAybPkwrFQmuXuFdHWjIjCwIJAw+W7SCUuH1:Iz9fFPkwZVuXuFdH0IewaSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650686123, "uuid": "27406ca8-4ad2-43ca-a1c7-e6b04a085c9c", "value": 3275264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650686123, "uuid": "c731c4d3-cd4f-4d8c-b6a4-eb040b5dbab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650686123, "uuid": "0f21a16d-f09e-400c-b225-d9e2c3ec35a7", "value": "Eagle Monitor RAT Reborn (x64).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109a322c-c299-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672320, "uuid": "72d879aa-1bca-4267-b328-4f0dec6e51c9", "comment": "Malware payload (Heodo)", "value": "00fa74cd33549e9382162a042e8e51d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672320, "uuid": "17dbe45d-03c6-4e98-b3e9-bff9ece7debf", "comment": "Malware payload (Heodo)", "value": "3910ba7659b1d31dbb57a612e314fdf005a3ddc35f08aa687a1591d672c470bb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672320, "uuid": "522b6eea-0e9d-465c-bc52-6d11fe54b22a", "comment": "Malware payload (Heodo)", "value": "74036e7dbddd7c61c1869b8769a45976a4e6ff1a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672320, "uuid": "a0ebeb51-61c3-4093-9976-3c2f7d876ef4", "comment": "Malware payload (Heodo)", "value": "8d76fef75d027e62e8d505a1e976a1cc5d8ea32cd30f15caccd3a4bddfe12aeece2267819b9d4f549728f4d98c03e57b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672320, "uuid": "8d9e50e2-395f-4c82-8f5e-422e1358f304", "value": "T112F48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672320, "uuid": "e2400329-99de-44ac-b7f3-a1662e4e33cd", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672320, "uuid": "9e7d6941-c0ee-477e-b861-a8f68a539452", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjKi0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvj3T0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672320, "uuid": "ec13dcd6-0860-4ca4-bc15-84bbc81a1262", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672320, "uuid": "10a09b27-70af-406d-8950-8ba4afdc153b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672320, "uuid": "1f41804a-c6c7-4628-9147-b995b2e6ec5d", "value": "emotet_exe_e5_3910ba7659b1d31dbb57a612e314fdf005a3ddc35f08aa687a1591d672c470bb_2022-04-23__000512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27530ee0-c2ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650708006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708006, "uuid": "2d8f3c50-b699-4cd6-9019-c184a34c157a", "comment": "Malware payload (Mirai)", "value": "117c2f860882b9ac9eb572aafcc884e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708006, "uuid": "a1e6b3cb-49cc-4b22-a9e6-144479ce3f65", "comment": "Malware payload (Mirai)", "value": "39e840239bd1304127505c75c1128fd245668b7bf2ff0d0c8bfa3643935a77a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708006, "uuid": "654294e8-87ed-4803-bdbb-db5eb41f6b23", "comment": "Malware payload (Mirai)", "value": "2f73753b9797e049a31916217123a971f5405dfa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708006, "uuid": "df331af9-bce3-4b39-9f61-6ef4885c883f", "comment": "Malware payload (Mirai)", "value": "2c29e59d5fda707623b98ce58c6e490d1d82a2be333f4eb6638fa142aee974368508e928a518770e0e7574bf23b5c9c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708006, "uuid": "eb63f46c-8f33-4d67-a1d0-8e3c30048743", "value": "T192533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F513BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708006, "uuid": "f09f2e13-d013-4ca8-916d-d71f87cccb87", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyjgGhd2G4NMiplImpcvwJZY10UPZvBqJ:0aHuAzgjjfUKU0NONyjgG+7XtJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650708006, "uuid": "aecbad78-d802-40e6-bed9-03057ced6bcd", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650708006, "uuid": "ad67d9e7-1f05-4e0c-9012-9c097bf9a65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708006, "uuid": "ce0fff0f-e640-438f-82f3-ddf15f31941b", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf8ede3-c349-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650748229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650748229, "uuid": "159c79a1-61a9-4e2f-af24-50c063eb34c4", "comment": "Malware payload (Mirai)", "value": "9c9afc86c8902df8d6ab3df40adbca42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650748229, "uuid": "63c5c807-a4c6-4cd1-9b79-f5a8f7b6ecd0", "comment": "Malware payload (Mirai)", "value": "3a77392055aff939d9977af7ae6885fcf4c23592db979d82c1243bc43b26fd67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650748229, "uuid": "e0c1ee15-0258-4d3e-80b7-ac4725f171f6", "comment": "Malware payload (Mirai)", "value": "3842e7a38657d9502bcbb56f3235e8e5e2ce026b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650748229, "uuid": "95aed381-6ba5-4846-9e5f-e28b7b6af818", "comment": "Malware payload (Mirai)", "value": "73e3b234e7830d53c45b915b764d4b85061027996353fa48d6e9764d71489a28ebb838d477a23d7db9f74f5added523f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650748229, "uuid": "1c00c9e3-affd-44ec-93fa-defce7a27389", "value": "T134B33A0798615F77C045ADB129AB5530072AFA120F4F1F9AB57DAAF4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650748229, "uuid": "d0b2f5de-20c0-4848-8812-25bbcc870e2e", "value": "3072:VATQs2B9odpVwuts5hLw7UWpLkY0Px9gQNfR:VAc/n0vts5hLw7UCLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650748229, "uuid": "15d7d98e-4d54-49e4-aeea-e7735ece38ec", "value": 108503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650748229, "uuid": "68cfa56a-fc12-4ced-b182-fb1d3a67d62d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650748229, "uuid": "7b579cc2-ee6f-4ab1-a557-598530762e33", "value": "9c9afc86c8902df8d6ab3df40adbca42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1013b27c-c299-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672319, "uuid": "951183cf-ae48-493b-a137-19532f1e503b", "comment": "Malware payload (Heodo)", "value": "f7cef1e7c04953a2d784276d7a0c58dc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672319, "uuid": "b4f7a9e0-7c80-47d8-94f7-1dd7001f4e61", "comment": "Malware payload (Heodo)", "value": "3a899e08d8a76177b05b5215f9456b4466f14339a769392bd6dc0097b19517fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672319, "uuid": "fc0ac2ac-cce9-4cb9-aa68-391231834c6f", "comment": "Malware payload (Heodo)", "value": "ce557f4004ff9f8d7051920865b8be04715aaac5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672319, "uuid": "f774a809-133c-406a-b5e5-109a8aa9074d", "comment": "Malware payload (Heodo)", "value": "63dd3efacec454f540b742e6969be131e3c0af6752664dcc8f08c2f4b5af38d7323be41140ce19e8a0995537ffbcee25", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672319, "uuid": "90b22b02-13eb-406b-a368-36b380c30270", "value": "T12DF48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672319, "uuid": "0786b8a0-8b0e-423c-a752-e36e56d34777", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672319, "uuid": "66c79e51-5949-4c7f-b7e6-01bde0ec7f90", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjwi0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjVT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672319, "uuid": "35f7d997-8e21-430d-af15-e62770ff7ada", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672319, "uuid": "f4bd5cb1-af37-4458-bc12-d533bd25e375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672319, "uuid": "667e5d76-ffe4-473a-b5fc-d5154911791b", "value": "emotet_exe_e5_3a899e08d8a76177b05b5215f9456b4466f14339a769392bd6dc0097b19517fd_2022-04-23__000512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4067903-c330-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1650737448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650737448, "uuid": "5e11fc6f-53fb-49b7-819e-24e5c4758663", "comment": "Malware payload (NanoCore)", "value": "5fd5e6453bf579a1dd628a75dbef6071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650737448, "uuid": "7dbbf0e6-72d3-46ab-b9cd-2232740bb681", "comment": "Malware payload (NanoCore)", "value": "3bb2d01333b78a2d4b58a3d27e22c7f84ce2a1fa277f8a4d9034a482389dfc25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650737448, "uuid": "8e998f44-1376-4fca-9fab-4ff882742fd1", "comment": "Malware payload (NanoCore)", "value": "85503c3679f13c622b983714ef34eca279c96f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650737448, "uuid": "6c8e5c94-8741-4562-8924-d1ff842ca8b3", "comment": "Malware payload (NanoCore)", "value": "ce1a8b0b03debcf272e92496e9e771781d5ec62d6434dd80d9acedc8b3a2d69d3b4ba1cf351d6482f98bf648525b7e75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650737448, "uuid": "fa20cd2e-bef9-4ec3-a37e-047f4283ec0b", "value": "T12D251252336784F2D53D0637FD83440D63A2BEE2D912C68F26C7B24A29367A24F54A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650737448, "uuid": "93f36476-99f6-4f93-9be2-cdea147d2661", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650737448, "uuid": "f56e4771-29e7-45b5-a395-6f1548c5894a", "value": "24576:dFQEFbS8eT32RC84JqqsQGCrU6ZSheB/d8f0M/qX8dmV0GpNyOxt+:dVe8eTqIYqseg62i/KJ/+H0G2Ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650737448, "uuid": "150e5359-d626-4a4c-a97e-b5e3cdc4317f", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650737448, "uuid": "bab5b94e-983d-47aa-b617-911ac0b0e31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650737448, "uuid": "f1366c0a-fa3d-4c73-80ff-d504e4ac3940", "value": "5fd5e6453bf579a1dd628a75dbef6071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ce1dcc-c354-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650752992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752992, "uuid": "b0b9be2b-65a0-4bd2-a887-d2e0c2a664e8", "comment": "Malware payload", "value": "b725933fcc89d6b197f212e6755f761c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752992, "uuid": "b04ab2ed-e58c-4771-bd95-9c1b71172117", "comment": "Malware payload", "value": "3bb615e74e78b755dfbd426611e97db8198e007612ce356e0946f3bd61258619", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752992, "uuid": "11284406-91c4-4529-ad85-e203a39dee51", "comment": "Malware payload", "value": "0ad3a33713f4cafadf7797ebd3cbcc5c8e6b28c5", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752992, "uuid": "00b2d1c4-26a7-401f-951a-138ece5f66f3", "comment": "Malware payload", "value": "4e646e98e11ae55b06d4030007f8b15f2208f14d41a5c04f6b14318437ed201ce0b72a03460153eaca847de300b7609e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752992, "uuid": "ab4bdfaa-6e85-4591-8eae-f4bfeffe1f51", "value": "T15C7723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752992, "uuid": "27e898a1-cff2-4d4f-ad9d-9448a54b49f8", "value": "393216:CADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8U:CAwwU8SAwwU8SAwwU8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650752992, "uuid": "35f72aea-2798-42d6-8efb-d7a1766ab558", "value": 35821568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650752992, "uuid": "0d964dc6-21f5-4f40-a0ed-42dd3abaed7a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752992, "uuid": "cf8bd6e5-5d1d-4062-aa4d-5f38ce6749a8", "value": "Windows11-setup_11.59931.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6b9ba2-c2cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Matanbuchus)", "timestamp": 1650694783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694783, "uuid": "f231b606-c072-42a2-8f1d-aac8415604d0", "comment": "Malware payload (Matanbuchus)", "value": "15c78dc6f4595d331d0636a1f871fa3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694783, "uuid": "9e24c15a-4aa2-4be9-9a7d-7d3ee226dec0", "comment": "Malware payload (Matanbuchus)", "value": "3cae2ce9b2d7040292f1661af63dc28e778027c46f78d8be3b1d43f4b6c2b046", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694783, "uuid": "e4bf3198-2582-406f-a9cc-64f4530d3e81", "comment": "Malware payload (Matanbuchus)", "value": "c34f09e219bb227fb4a67a879cab9ea4e6c3cab8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694783, "uuid": "1acbc52f-b15c-4e4b-9c72-6ba94a4cda44", "comment": "Malware payload (Matanbuchus)", "value": "2c1715d6a53cef1f201a00f0da5d37b343a99beae6f3ab202ae451aa500f46cb3b5ca3302d14070dc8434831ce9ccb29", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694783, "uuid": "0921658c-dcf9-4782-9864-61cc4282c535", "value": "T1E4543911B500F132FCBA04759E749AB04A2E7E309BA805CBBE8C7F2E597F5C1A524E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694783, "uuid": "deeb09a4-c3c2-4128-b7ac-90227a097169", "value": "d86e96cd523f0d88359af350afd73632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694783, "uuid": "d20c226b-8b45-4b1a-a599-874b10ad7d40", "value": "3072:c6mvqcGPwK96Q5OqyaH1MH/oanIAW+Z7fmq9OhqZWXYWrrRSVMnvw84XWpWeZj6H:mvqPn9BOqvmAarWq7fROnMSkdh4sSCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694783, "uuid": "9a4c940a-f234-44e4-9929-24d62fc7454a", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694783, "uuid": "152e8aa8-06b9-4753-8092-60fd6742c531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694783, "uuid": "14a3d6fe-52b1-417b-af9e-03545d687882", "value": "15c78dc6f4595d331d0636a1f871fa3f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6316f212-c2b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650684484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684484, "uuid": "767e2c4d-591d-433e-ba0a-9a5f73526934", "comment": "Malware payload (Heodo)", "value": "7b01dfce7314e8b72d7de9cccedc3896", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684484, "uuid": "d59bba0a-0d80-4a21-af27-abdd20cd1c12", "comment": "Malware payload (Heodo)", "value": "3d0b477aa237649caa3d9eb0bfee249a6ed9a6d7dcb7782ebfbef2405ed50682", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684484, "uuid": "58a213ac-8633-4f46-9bed-314dec7c9f46", "comment": "Malware payload (Heodo)", "value": "e69f44a766746cc77df790a1f9bc49f7f0c88221", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684484, "uuid": "1465d8dd-a4cc-470b-bcb2-b61401739b1d", "comment": "Malware payload (Heodo)", "value": "391c1872da6794310e06cc452395fe511c5a893761747c8d9844d4072597dacf3bd58ff457f38503e5d60d2264217cc9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684484, "uuid": "06e6233a-0c74-41bf-8c2a-095a2ec30041", "value": "T12A84190173C390F0C657A574840FD525ACB7B83C6B18857EB28BA26F4BE79D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684484, "uuid": "1a3ee88c-8fca-4ab8-8f44-58390a753633", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684484, "uuid": "c489ff15-188a-4b19-9019-39421cd8aef3", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhA7ArkqB6:S54yM33d3q3Z7Bogxr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650684484, "uuid": "0d8a38dd-71eb-4dfc-9663-32b93245a4c3", "value": 390408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650684484, "uuid": "39c5816f-d2a4-4965-9a6c-022fa0da15c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684484, "uuid": "51e9ab80-cfab-43e3-a5c9-6d97fae71a1e", "value": "emotet_exe_e5_3d0b477aa237649caa3d9eb0bfee249a6ed9a6d7dcb7782ebfbef2405ed50682_2022-04-23__032759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7bcef2-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650680720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680720, "uuid": "44c7faab-ad8c-4c7f-adcb-cb1a082353ec", "comment": "Malware payload (Heodo)", "value": "929f474f0d77618431aa4baf026a996d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680720, "uuid": "c4631929-06d0-4fb5-9e74-b2f38565008e", "comment": "Malware payload (Heodo)", "value": "3faf043d921a5b5c6ca147384df9de103dc39700c3ad567c65cd3688add46f16", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680720, "uuid": "d5dcaa12-2cc7-4e34-9954-3bf480e6d589", "comment": "Malware payload (Heodo)", "value": "9f60ea5dbbf6889ae2bc3f4b9afdbc97ccf379bd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680720, "uuid": "cc0cc34a-cc4c-49b0-b975-6e7ea0ccfcd7", "comment": "Malware payload (Heodo)", "value": "a6563a2bd451a500e69f647eedf00f9ae9a0292a44512fd87c8690d7ff35ec2239ac1686784a1e5cb8b17899ae621431", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680720, "uuid": "94884dbf-2f10-4f13-bbaf-0946c1b57b20", "value": "T1FFD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680720, "uuid": "126196ee-c0e4-47da-bf3f-70f53df4f87e", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680720, "uuid": "af8580f8-f44f-4090-917d-70646040a7bf", "value": "12288:C1FIcocJwMTHzXO7N2qBHiyzskF1CubVnmn:tco9MTHzXO7Nv/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680720, "uuid": "1ed32905-dc2b-4781-b191-5676cc8bccff", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680720, "uuid": "759c9cb2-fba2-4db4-8031-a05e6fda1d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680720, "uuid": "563d298d-1913-40ec-98df-cc92d72e4ed3", "value": "929f474f0d77618431aa4baf026a996d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44e8ffa-c2b3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650683815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650683815, "uuid": "c1e06b31-21ff-4cb2-994f-deee0d26d096", "comment": "Malware payload", "value": "a6242d6629ca187d080de2f4fd66afa3", "object_relation": "md5", "Tag": [ { "name": "varal", "colour": "#7200EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650683815, "uuid": "dd44b7bc-e4a0-4b49-9848-ae62230a185b", "comment": "Malware payload", "value": "41270df223cbbff5255b79bdf464f8658a0f7b1ef05628221ace13d9ad7847c1", "object_relation": "sha256", "Tag": [ { "name": "varal", "colour": "#7200EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650683815, "uuid": "daac96a0-7c44-44ab-a01b-5164d97ebc03", "comment": "Malware payload", "value": "3973d3f14d88145e71ec6027d9769c7da2a00eb4", "object_relation": "sha1", "Tag": [ { "name": "varal", "colour": "#7200EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650683815, "uuid": "8bb5ac8a-088b-49ac-a2e9-7baa6c0e7754", "comment": "Malware payload", "value": "8c4fdd7d782992e5c4286a65bad12af8eb38a522d000a923152d198a3bd0781bac726c59d119480b3c5454074883e037", "object_relation": "sha3-384", "Tag": [ { "name": "varal", "colour": "#7200EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650683815, "uuid": "505138b0-94cb-481d-99af-ad050c0d9b8c", "value": "T10A82898F92B3DA81DE11458AB54C8EC605F6131202FF9DA7BF2ADC4907C49B5B608B5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650683815, "uuid": "07d82d5a-3e0e-4f49-b1b0-5174b66e3d7a", "value": "384:YpbjY/TJ+2gANQjTzj6kipLjnAVo4U2bkoh8vmxh4zJf:tJvJFHAVo4U2b7Kmb4Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650683815, "uuid": "39c28d9c-9060-4bfe-a907-5a81c96781db", "value": 17936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650683815, "uuid": "98d62449-05cf-417a-b5aa-09b4cb25aade", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650683815, "uuid": "e9bb3c32-e56a-47dd-bb4d-5c01226f7098", "value": "Virus.VBS.Varal.a-41270df223cbbff5255b79bdf464f8658a0f7b1ef05628221ace13d9ad7847c1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730b2128-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650693531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693531, "uuid": "cd42d71c-00db-4c7f-a238-faa8c1f102fc", "comment": "Malware payload", "value": "88105193a154dc03d2ec144c5b965661", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693531, "uuid": "1951bf5a-db89-4aeb-9973-56bbd9e5fdf1", "comment": "Malware payload", "value": "41b575cbcd2bc64463cf807b2ca31065574e27a86c31c66fb097e4a7b216e05d", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693531, "uuid": "501a20c3-cc37-41f1-9ef7-04a24c9abd31", "comment": "Malware payload", "value": "dca1a8bb758e26aa33524a1662ce45403a8f0c6a", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693531, "uuid": "419c708a-d1ce-428d-9502-144763c69ba3", "comment": "Malware payload", "value": "4768ce2d8d8cfa06c6f3c4296cb904815ea3c02b99d3448925a4b985f26ba3c8c7cdbd2e64d726fbc32cc18e17d130be", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693531, "uuid": "3f6aaa38-0a32-4411-8b38-a75f51732fdf", "value": "T1E2C48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693531, "uuid": "225cff9c-9178-4ad4-8e58-07b59a51c8de", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693531, "uuid": "59e068e6-ab42-435e-a9ff-31a1b34f6a75", "value": "12288:ln/zDvGHAykHSzLW/4+8bzbBSreMdZhgFK/UqWZ:pzbGHAzHAjX1UcLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693531, "uuid": "fc03706d-bdca-41e2-a192-3679c0499483", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693531, "uuid": "623ee60f-8ba0-4d21-9dc2-3490968f3c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693531, "uuid": "04addd53-c7b8-43aa-bd8e-87d9611d247c", "value": "PO.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8e32ab-c316-11ec-8e58-42010a9c0032", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1650726400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650726400, "uuid": "64bfeaaf-f76b-4b8e-a749-861df1dabdae", "comment": "Malware payload (CrimsonRAT)", "value": "049e496477102f29126fde8d80c9e847", "object_relation": "md5", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650726400, "uuid": "1066b77a-af5e-4199-9e91-84e7bceccf55", "comment": "Malware payload (CrimsonRAT)", "value": "4342dd4999d1247fc9032003bafb7d3d58d2cbefe1705d5d91e258d0ed1fef86", "object_relation": "sha256", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650726400, "uuid": "db8461e6-74c6-43de-b45a-a9beb63d1acb", "comment": "Malware payload (CrimsonRAT)", "value": "7dff5cbfe65beebc4d4d10e6afeaffe2f142f8cb", "object_relation": "sha1", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650726400, "uuid": "e2044b27-1b95-4839-aa06-080f2ed265c5", "comment": "Malware payload (CrimsonRAT)", "value": "a9766c5e1e2ce93804063019d2324a7ffa9d35a4e4ba8506649a3b633f204974fe2819c0cfe3bbc10eacd5475dd3d253", "object_relation": "sha3-384", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650726400, "uuid": "f4560bf5-9db9-43c2-bae0-2a65c096af82", "value": "T15BB6A26C7704E19BD8665A348E43C7A4AE643CF26D8284A3F786774F09F6F91BD010B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650726400, "uuid": "245179a3-e1c2-42d7-8048-3098c4db39a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650726400, "uuid": "ad7a0b72-eddb-453d-8e76-d2889a5244e6", "value": "1536:D1wiwxwdlQwizZ+WC7XrSpx2Z7JTf01p5kmSGZ8:D1wiwxwduwcZ+WAXrSpx2ZZs1p5kmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650726400, "uuid": "d8bc16b9-a08d-4b5e-91db-43da37152598", "value": 10958336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650726400, "uuid": "313ed15f-d2e1-456b-8ab2-4818d4cde8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650726400, "uuid": "703a464b-6e84-44b3-b10e-167d3e8b7dfd", "value": "049E496477102F29126FDE8D80C9E847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3172195-c2a7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650678606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678606, "uuid": "631ce751-c169-49fe-b071-136f82cb9977", "comment": "Malware payload (Mirai)", "value": "82b5c57b221bace647fec594e3c716ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678606, "uuid": "07341af6-4ac7-4a76-a850-644010c6f3a0", "comment": "Malware payload (Mirai)", "value": "436d1ff0ecab188739585ea44c8e66c9a55d6ec35417f7f0caff969f1a43614e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678606, "uuid": "3917b6c1-9213-4202-aa25-cf7adb5f089c", "comment": "Malware payload (Mirai)", "value": "bd24c68431a26bbf2d90c45b7d9158eeea7f0fbe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678606, "uuid": "dd68284d-a967-49bb-99a0-d3eb65389e79", "comment": "Malware payload (Mirai)", "value": "f719c2fb747d3dbbbd6c1859ab8c346da14be66aeeccfe09fb1d687fca26bcc447be9856d38df491314cf89859d83c0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678606, "uuid": "265bc927-4f08-4806-bf3a-ceaf18bff78c", "value": "T103C2F10061232871E630993AEE3E6F4977036FE041EEB1F56691537EAD88B6F3678705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678606, "uuid": "f3017fbf-1654-45de-b3fb-d22ccfb608ef", "value": "768:FgvZFfdEZMHhqOidieBOXQAySL3nImypbs3UozUz:EDEZMYOidPQZyonISzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650678606, "uuid": "5772853d-a1d6-48a1-82e4-06722132ea98", "value": 27472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650678606, "uuid": "f6e723e0-eefd-4a3d-a233-6167e68338b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678606, "uuid": "e9b2e956-0599-472f-ad9e-a112ec92d0b3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77517e24-c30a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650721026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650721026, "uuid": "3dbf6e86-2eb8-4e85-9ccb-1ffbec1fa153", "comment": "Malware payload (Heodo)", "value": "58c7ca42713600f10aa5da6c761314bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650721026, "uuid": "1d62a718-27fe-41ad-9270-23e86b5de65c", "comment": "Malware payload (Heodo)", "value": "44cee814f2ce9d53cd447069bfe667944befc8c3a48bf25020a980972a946b6b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650721026, "uuid": "1a9336b9-50aa-4242-84f3-935bef2457ef", "comment": "Malware payload (Heodo)", "value": "e3b6d671cadf2375329f8088cb449db71512c4d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650721026, "uuid": "4d6441ae-a97a-4369-916d-9bba3682c186", "comment": "Malware payload (Heodo)", "value": "427f0a5ea188caf5fb9d8ea687be627ad6caf9db7f171484a212776237fc48be6ea3899e665493caa168d6d09be95b36", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650721026, "uuid": "47cca56a-41e9-4d80-814f-e1d3f83fb9a0", "value": "T163B4AE41F6E18036D5BA26342EA52B369BF8FC504F70EAC797E1CD5E1C326C25A36712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650721026, "uuid": "ff16a2b7-9f18-452b-b59f-b7071a4e2e39", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650721026, "uuid": "5346a8e3-6124-4994-92f4-ab15de3d694d", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQPJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzdDIsogYLTtQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650721026, "uuid": "a982afd9-567f-45e9-a5e9-681005a2f9a3", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650721026, "uuid": "c2909085-51f7-401f-bdf1-f576eea8165d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650721026, "uuid": "1c49c37d-ce5c-40b0-beed-a6f3ad4ac0c1", "value": "emotet_exe_e5_44cee814f2ce9d53cd447069bfe667944befc8c3a48bf25020a980972a946b6b_2022-04-23__133701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523907f6-c333-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650738573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650738573, "uuid": "ae7d3fb7-2c65-4056-ad1a-eb0675aa3590", "comment": "Malware payload", "value": "5a8366a8f35f3452439ca10d0884eaa3", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650738573, "uuid": "96f40a93-c739-4d30-aef5-fb013e172706", "comment": "Malware payload", "value": "44fb58b87a9a4d36e6ffe588edf5da20bfd6a9e3ce98ec068f88d2f16b9eb612", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650738573, "uuid": "04f8bb75-8767-4dac-85a0-18120bc598ed", "comment": "Malware payload", "value": "b90f737a292f1bd9de3cee9046b69ecfe0f1bef0", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650738573, "uuid": "24289938-767f-4571-aa71-18f92bbf4063", "comment": "Malware payload", "value": "170c7ee5463eeb1b57b2edfc31f612334e76ec6cd7675e5a07278b4cda08fd27a82e6e868fabf62bffd37e0cdf51d79c", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650738573, "uuid": "643f828d-2796-4fa3-afbb-c95081fdaa56", "value": "T14E8723FBB258653EC45E06324572923C4937BA6D6BCB8C1A17F30D1DCF2646C1E3AA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650738573, "uuid": "4b47480a-9b25-4f8d-b225-b243c3f36148", "value": "786432:NkHiLGD67reN+8kkHiLGD67reN+8kkHiLGD67reN+84:NzGD67rePkzGD67rePkzGD67reP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650738573, "uuid": "55de3315-88dd-4e3a-a7d2-71885eaa8d69", "value": 36089856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650738573, "uuid": "82c8bebb-e4e4-4b1f-b33a-4ef0ede18c88", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650738573, "uuid": "d47f5a02-b068-4ce8-a407-1557301fd4b1", "value": "Windows11-setup_11.45288.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9c6a22-c2ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650681009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650681009, "uuid": "bb35d88f-b891-402d-a356-2528699dab69", "comment": "Malware payload (Heodo)", "value": "3618f85a7e172e76aa3e0044e34cf59f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650681009, "uuid": "0ae03730-531d-4674-ac0c-8b70e25a3652", "comment": "Malware payload (Heodo)", "value": "477283ecf77f4e4832d1abbfd6f46535d0393ed110238798b1e13ef15ee81c57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650681009, "uuid": "de70ed06-4095-4faa-abef-a448c69b63c8", "comment": "Malware payload (Heodo)", "value": "3a40799843ae86be64f8065b4dba47f4dcc61e6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650681009, "uuid": "dd570113-c367-439f-a356-dae71cd1983e", "comment": "Malware payload (Heodo)", "value": "ed9ed4adb980a53f077f8f9410251bbf7678c6233da70121fa63b9693aa144113e48274a7555da31b0eb9c8f8c17150c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650681009, "uuid": "2c89e49f-b6de-40c6-b6d1-78c18a2a52fb", "value": "T197F48EA23193C8B3C3FDB37009828E58AF61FA9557B31257EA90153EFE748E5A3605D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650681009, "uuid": "d4224b80-4f5a-4116-9dcd-48bcda25bace", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650681009, "uuid": "3a509732-ba62-463f-a84f-53f4b705bc43", "value": "12288:Wvz1CLJyyvmMLSrBg34ruGbPlVpqb+DlY0:WJCLJyybLqB64ruA9VAqDlY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650681009, "uuid": "eb56263b-7c41-4718-9eb2-337d6f0c3296", "value": 769840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650681009, "uuid": "1cd3f943-be42-4b10-8db7-f5ea0ac04707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650681009, "uuid": "01c53948-5bd9-4cf1-aa71-874d0a8181a3", "value": "emotet_exe_e5_477283ecf77f4e4832d1abbfd6f46535d0393ed110238798b1e13ef15ee81c57_2022-04-23__023004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b03fcb-c359-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650755159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755159, "uuid": "a7e96cd0-00cb-40cb-b1c8-bafaf7166c75", "comment": "Malware payload (Gafgyt)", "value": "6f5fb605325fd5aacf1d0f9698d39b59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755159, "uuid": "c6eb3a9f-4ec5-4912-878d-1a66be928988", "comment": "Malware payload (Gafgyt)", "value": "4910ad0dd7d99a448e306bde0aed5ce031a4a8ec2d6e8ffaddca22e9f7b65971", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755159, "uuid": "b8cfca6a-9273-49fa-8f42-57f792c8bb18", "comment": "Malware payload (Gafgyt)", "value": "e8b08f8aafedb0cff81189fa0261e6967947a6f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755159, "uuid": "a000c0c2-f154-4ec5-b43d-a3465aa56782", "comment": "Malware payload (Gafgyt)", "value": "f98f480362629cc6851914870a19e740cdc90c65d730e5a9cbd9a7b87c9861f966d8e4672e614cde79a759b0a8e50bf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755159, "uuid": "ed7788a2-a612-4075-a631-336d57284074", "value": "T1A0F2E10163C585B5E1B64C3EBB1E8346689F5DFE82D3305A531095B2BBC164AD7F93C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755159, "uuid": "8b31e72f-fc9c-458c-a991-7bd5d675bead", "value": "768:8eordRgpff3I/KUCl05t0yWW/G21Cg/TV14O+s3Uoz7PB12:8fdRgpX3yW0bTW6lCg5m+zP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650755159, "uuid": "6b8f9c86-3737-47cc-9bfa-fc6c93507983", "value": 36532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650755159, "uuid": "cc4e4d46-5c95-46e9-8995-b2df55872fe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755159, "uuid": "66e15680-f595-4b29-83e2-2f610a0973c5", "value": "6f5fb605325fd5aacf1d0f9698d39b59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf28a32b-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672210, "uuid": "9d0bccd0-b22e-4a42-a02a-dfb4502a87fa", "comment": "Malware payload (Heodo)", "value": "fa41c84483d719edb5d3518a70caf41d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672210, "uuid": "b142cb15-d704-46d4-9f9a-dea74dd3278f", "comment": "Malware payload (Heodo)", "value": "4998a17d940cef600e8c831315743ce6079a41a9eaf59d15914a7ef04ab0f40d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672210, "uuid": "0ed823c8-0d76-42c9-a83c-cceb6660d749", "comment": "Malware payload (Heodo)", "value": "08efb77ada9e361e870f2d2ac3c086ca27f51122", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672210, "uuid": "3ea33574-8d1a-4b3c-b1f5-e8060018163e", "comment": "Malware payload (Heodo)", "value": "eea81006b316811db16f161b7d2775f04174124842a58bb2880df79ca3a79a9e155eac4deac2ab69cc162fa50b718cc1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672210, "uuid": "fbbfa8e1-da08-4da6-a4af-beb529c9e3a2", "value": "T12AD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672210, "uuid": "8b1e4330-62b6-4a1e-96bf-f1abda6a76e5", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672210, "uuid": "0d8611b9-ceb0-4a01-ab75-6f5f8c0c8ae2", "value": "12288:C1FIcocJwMTHzXO7N2lBHiyzskF1CubVnmn:tco9MTHzXO7Nw/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672210, "uuid": "86ba4c00-a4f2-4538-a03e-33e9509a0dde", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672210, "uuid": "abfd5a70-8339-4b1f-8a06-9d126c8d0732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672210, "uuid": "b4c2688c-4dad-450f-8c16-7d8990acc7e0", "value": "fa41c84483d719edb5d3518a70caf41d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625e8a07-c310-11ec-8e58-42010a9c0032", "comment": "Malware payload (Babadeda)", "timestamp": 1650723567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723567, "uuid": "4f2db8b4-2d1e-4121-a74b-24fb3cfa17ac", "comment": "Malware payload (Babadeda)", "value": "a91c4ead55dc9611af4619b96c369800", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723567, "uuid": "8ab56b70-b320-447f-9912-b3f7b230126c", "comment": "Malware payload (Babadeda)", "value": "4af7e9ab79d451adaa60f6ce0837113da64398b9ab9dbfd31521549c8719dfa1", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723567, "uuid": "155c868a-a058-4a34-a425-7cb14d4fff17", "comment": "Malware payload (Babadeda)", "value": "60236ff0f6377ec3e0b3379d848cefd9651b7631", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723567, "uuid": "475bd811-a125-4d5b-a224-53e96af8a43f", "comment": "Malware payload (Babadeda)", "value": "b1b26135438fc834cb9bbfbfc8e75bec257c1449560d4cf9eaff067e40fe131ebddd52da828c6055a5d0bdba6d0231f1", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723567, "uuid": "0acedc35-ae0f-43ba-9304-bdd8cbe8841d", "value": "T140C42EF3A3AC915EC4528C3FB199A47D0E022DE741C879D191A8BE3BB4B1293C59D937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723567, "uuid": "a5639ace-598f-4cab-9b50-27a9292edb1f", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723567, "uuid": "8846e9b5-f72d-4477-ad6b-2e5899437579", "value": "12288:kKyNTbUerOEZlybVN8q6a/poBRfBBfOmzojOC1R3psxUMwj7YcgWXN16fPScK35m:kTTbUerOEZlybVN8q6aOBRfBBfhzojOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650723567, "uuid": "2d75e655-74f3-49e2-877d-a839fbc02743", "value": 582304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650723567, "uuid": "1e610eaf-ca3d-40bb-b5e6-2a2dd0357707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723567, "uuid": "4a99dab0-7805-48ad-a930-9b98890f25eb", "value": "Install-Tasty Bones XYZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23064848-c2e5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650704993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650704993, "uuid": "4ef3211d-b06a-445c-a458-b99c5c002ffb", "comment": "Malware payload", "value": "1a397c299594594389c2f1739fb9b163", "object_relation": "md5", "Tag": [ { "name": "AID", "colour": "#62258A", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650704993, "uuid": "c007448b-3cef-49cc-967d-b55bfc313b9b", "comment": "Malware payload", "value": "4c264f11ee743a1529c1adc7df97081f0740d3e22a87b3004b060fe645036663", "object_relation": "sha256", "Tag": [ { "name": "AID", "colour": "#62258A", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650704993, "uuid": "18b9bc9a-dcc9-4911-8934-98ca54861529", "comment": "Malware payload", "value": "459e3dd065a7e7cac517a3de02cbe1e0de9158f9", "object_relation": "sha1", "Tag": [ { "name": "AID", "colour": "#62258A", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650704993, "uuid": "c0be0bba-4a5f-426e-b978-68d7bbd21766", "comment": "Malware payload", "value": "fab593ad05496ff8249f58e7f4347ff8a35de55d12fcdbb5c6d53b1a910cdd708f726632a822218f0fac35596e7f8c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AID", "colour": "#62258A", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650704993, "uuid": "e57f42f1-4e80-4846-98f2-df10cd30d64a", "value": "T102F4AE22B9C280B3E2A1107555F99B771E7CB524A7118DD3D3C40EB99E212D0AB3F79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650704993, "uuid": "46da82b9-9dc3-449c-9754-3cc154167141", "value": "36218d8b905362c7cc11ea6de48b5116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650704993, "uuid": "1b9236c3-dfbd-4d69-8c8b-100bacd65ed5", "value": "12288:sh3rELUPoGAiiBDHtAggOnN3Fn39sQaWE0jas4Pzkqj9Jv4GC1RtKt8jlaIDGjoA:shxcN9sSa/zkqj9JIa8jlHkoB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650704993, "uuid": "f456ebfe-c7e9-47a9-be9f-fd2d4b79ed6a", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650704993, "uuid": "f49e6569-3c17-40f9-8373-edfdcb1c8902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650704993, "uuid": "99367f0b-93d8-461b-be27-52b94d31cba5", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e250ddd-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650693522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693522, "uuid": "131aae2d-6a86-47e8-b621-6bfffe525e88", "comment": "Malware payload", "value": "76de761341412d573405957e15c96787", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693522, "uuid": "4d7e6632-a390-474a-a351-a437732fb272", "comment": "Malware payload", "value": "4c5cf5e22f6a78dda1577982a4b7849d537fc982eba0fa30fd2d60b3ee0c7d5a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693522, "uuid": "5e9edd5c-a7df-42f8-a4b2-644adf50a8e0", "comment": "Malware payload", "value": "ae73b7b9c288797099a7051be94e593020259955", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693522, "uuid": "44fcc9d8-8ef4-429a-a5fb-152b7bfa5e67", "comment": "Malware payload", "value": "cab3c749aa8d302da2611684410513589651ceced0d4819de222c707f95782506f84d41d72d69d84c4a04b81cd826c3e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693522, "uuid": "0a56ed6b-7691-4b4b-a86f-367baa97f3eb", "value": "T135318E251BDA8374E3F14E72BC7EE32495A2BD46CA5B872D0280D5D46D50204F832F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693522, "uuid": "4b399131-c1bb-4ece-af5b-a66ee2e32263", "value": "12:8EhY0m/7MwMlXgVSXWIr4Ri6EX6HDyjA6PBW+UcXri3Wlno0ITMf88iNNZYZJkH5:8fJj4K3KVA6PA+/XGGlno0wi85A343H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693522, "uuid": "931c71b9-1b54-40d4-9734-42a549c32ee1", "value": 1625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693522, "uuid": "de9f8755-b748-435b-bf29-6793bc1afaf1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693522, "uuid": "58913d93-f4f2-4fc8-b02b-b018cacc1f75", "value": "documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d426094-c2d3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650697252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697252, "uuid": "b58e65d9-e653-482d-961d-aa441767e937", "comment": "Malware payload", "value": "d457b274071cb24f55132d961d07df92", "object_relation": "md5", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697252, "uuid": "3708215a-350e-4a77-b4ed-a795ace1780e", "comment": "Malware payload", "value": "4c73d7c6ff35f72670578de0424c9e4cd5c75cc7b29115dec0a6dbd90cc0b2a6", "object_relation": "sha256", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697252, "uuid": "da30988b-ff7e-4b5a-b502-57f1e9436cb5", "comment": "Malware payload", "value": "5bcdf162cc7b62a3b3eb8b85a3050d5a4ca9b15c", "object_relation": "sha1", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697252, "uuid": "906f43c7-7357-41d0-b829-ee1a539d112a", "comment": "Malware payload", "value": "d57eecf3e3f1793dfb4f638cbe37d89599358fd27102b03c79b0a7768d5c511d894bf39be1a0297360d444f911304a0a", "object_relation": "sha3-384", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697252, "uuid": "722b33fa-703e-42b5-a8a4-edb93576d369", "value": "T17611120C3D178532C17182ED6A31F988933AE44170B889947688C1FA354254EF7D3BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697252, "uuid": "8ed5e990-6d1c-4a74-ad58-3a712ce53517", "value": "12:Rlz9qEUrCEi+D0hOSZQi0fXR7ERlGLEmyB2YWA7hFuMXHLezXIeuJVMYpr3SZ/MO:XIEg5Y9ZQiUclGq1bP7OIeubM0cMA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650697252, "uuid": "1f934e92-ab3e-431f-9b5c-c2b5aefd72b1", "value": 862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650697252, "uuid": "09e15e30-4931-4a49-8c1a-4b3a8ef552ab", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697252, "uuid": "57ebff87-e8b9-418e-bf97-4ef7ddb9813c", "value": "test.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5044ac-c2a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650679343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679343, "uuid": "e56b2951-9317-41b7-8ee8-a256ae683dcc", "comment": "Malware payload", "value": "a3dc7df15140713154fe401d447b8226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679343, "uuid": "86ee5a5e-8d30-4fb2-b941-0248fba09737", "comment": "Malware payload", "value": "4caa96f3601e47b41c73951e22e3c42aa012a64e83eafcd164ddf1363a9b4c80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679343, "uuid": "fbd31c3e-ed4a-4fdf-9f90-52635edb4362", "comment": "Malware payload", "value": "cc9f46a6fbe786ab56d4399d73a475ff89880ffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679343, "uuid": "197c7d0e-40b5-4aaa-b2ac-232134238467", "comment": "Malware payload", "value": "289b0141d663c17833e9070159e74098caaa6f28ae2b6cbdc075436744928773752996bcfbf7caf63c6d6eb2dc3c1b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679343, "uuid": "dc8f5a42-e6bf-4376-9e5e-9090fb193d81", "value": "T102D251D87DA85DD6EE11533E55F7C2223A3CF5E08B4347577730763A2B03AA22AE4246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679343, "uuid": "962f9361-8c46-4b23-9b7d-14a1408ffaf5", "value": "c1df82d807ccf407a28a81c6f970190a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679343, "uuid": "0a951c96-a6d5-461f-81ee-fe79c16b87c6", "value": "384:56NolEd7DvYgY8qNXUd+vgvD54gM5oazHXd+Uv:Gd70vgr54gGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650679343, "uuid": "3c5b9ebd-6f81-4950-912e-160eff1ba7d4", "value": 29876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650679343, "uuid": "bcb92fc8-56f9-4a70-974f-ef4aad77a3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679343, "uuid": "72f40b4d-eeb3-4e9d-b174-c66f362b18a6", "value": "OH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbbad77-c29f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650675003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650675003, "uuid": "c73cebf4-1b39-4894-a5fa-327edd007803", "comment": "Malware payload (Mirai)", "value": "5e1c0d36701394c0b56e894cf0f67f98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650675003, "uuid": "8ab65546-8cad-4de2-98f9-7692bf5760d0", "comment": "Malware payload (Mirai)", "value": "4cf625875df42f1d7e7d839e7c8a0f9d15c1aa00dd289234839bf992899a9780", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650675003, "uuid": "f1658b2a-963d-4ab7-9e0f-92b18d7d5d5b", "comment": "Malware payload (Mirai)", "value": "98d573dfd427210dabccd035a94ec3a16cf195de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650675003, "uuid": "287bb1a4-7432-45c0-afaf-bc5cea98ef51", "comment": "Malware payload (Mirai)", "value": "2aed8fc3f41a015bd7dc0a38fb2b9ef9087b56d4aa6d3af9efc764854a329d8a2f808a3b756418667be263e5dba6cc15", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650675003, "uuid": "b24ed38d-2232-4ef1-8484-ede539c4776d", "value": "T16A634BC4B583D9F6DC1341B0A077FF36DA36E1FA115AEE83F3E49A236841A12950769C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650675003, "uuid": "9b08ef34-3040-4432-a7da-e33cfa646f5e", "value": "1536:SR54NbAscra32X3p/5va9kND6eFdSnWZB3zLr:aibAscra3ExN+ezoIJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650675003, "uuid": "0439a934-a7fe-4257-92f5-aa2216a8bddf", "value": 71796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650675003, "uuid": "fda17c0d-7d73-4c22-b22c-ae6549f7e9d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650675003, "uuid": "76544442-e354-443e-9a04-f09a3a761e53", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2a445b-c2aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650679698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679698, "uuid": "c0f0389f-e94e-41f1-9593-9d8952f29a2d", "comment": "Malware payload (Mirai)", "value": "8a0618e4d4f65c172666f01ca95cca28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679698, "uuid": "10172c06-5f8d-49ab-ab77-ab3cf3db281a", "comment": "Malware payload (Mirai)", "value": "4f49988d7c63859f25680ef872e57ec1e72de9529620c8725e9068efb22a5e1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679698, "uuid": "1c46f380-0ef0-42e4-8d67-3e6b77337875", "comment": "Malware payload (Mirai)", "value": "98952a3497300d295c156adc97e474d7728c2c16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679698, "uuid": "cf1641df-936a-4184-9837-90740b45449f", "comment": "Malware payload (Mirai)", "value": "9a91a2ea770ffdcb1daa703ea66c90fe516c07db57f95e6572ddd5ac448473344deff804dc30b6cd7306a9d5bb15f17f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679698, "uuid": "ca973cbb-4d8c-4364-bc4b-a601f22aa6fe", "value": "T1C0A3D70E7E259F7CF7AD823547B78E25965833C626E0D640D2ACDA101EB024E641FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679698, "uuid": "8dc72be6-47ca-4b18-ae24-7fe81c90b333", "value": "3072:OOyHOiMGMjEJ+cHCen3kgQ3Hjtr7WZhAJSKpc:OOyH9cfGCotAjZ77J9pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650679698, "uuid": "81a9be4d-4f1a-4f0d-9aa1-81fba99341dd", "value": 106676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650679698, "uuid": "b813e52b-6f89-455a-8c1a-4c9dc7f8f1fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679698, "uuid": "f6ccebea-06b3-4e63-bbb0-3c9b7a82bec6", "value": "8a0618e4d4f65c172666f01ca95cca28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a72d698-c2c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1650691771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691771, "uuid": "babe3f8d-a186-470d-a7cd-cdec08e774d6", "comment": "Malware payload (NetWire)", "value": "090c849e14fb518d7e850e12818f6ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691771, "uuid": "4d10a067-aa2c-41f5-b6f4-ec213d7078d0", "comment": "Malware payload (NetWire)", "value": "50d0c37267fc4b803c156b1d494741bc9bdaa7b16d9dac19b8f8af4c9fd57e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691771, "uuid": "fd12d288-1eda-41c8-9dc2-1cedcf0794b1", "comment": "Malware payload (NetWire)", "value": "09d15f8fe5fefe54f0a976d2f2a7c720d3770d4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691771, "uuid": "4ebfdada-ad97-4b85-b5cc-6a760babdd41", "comment": "Malware payload (NetWire)", "value": "ba69cea56b9c93136f14d49c1500b422acdcab60452c42b4f192cea889f3cf48e4db4a307e4aab2a468045173871e042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691771, "uuid": "a4c9ac77-45eb-450d-bb3b-37544140a500", "value": "T13CE47C22A2904532D0761FB44D1F93B9782ABE20FE24A9463BF8DE0C7F756C1752E197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691771, "uuid": "00074b82-57d3-4da1-9eda-8b399ec08113", "value": "9d8ab20f0cba88c2b6a2c1da71492b3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691771, "uuid": "82692048-2ebb-430b-aa57-115f8cd24523", "value": "12288:0v6HDE3sjU/Ekku/n5KAPQ4tdyQJ9iFEep9AxKzaRHrU:0yjE4U/PL/n5K+hxJcFEQ9rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650691771, "uuid": "1a6e1f25-ca76-4d67-ae3f-460e2af9665e", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650691771, "uuid": "23d7d260-d08a-47ec-b0d3-a50e900071ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691771, "uuid": "c2084cf2-3db0-442d-8671-e0ab7074e005", "value": "SecuriteInfo.com.W32.AIDetect.malware2.3409.24921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8953283e-c308-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650720197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650720197, "uuid": "b3d93cb9-05d5-49ec-afd5-48593301a533", "comment": "Malware payload", "value": "e6245fb474170eeb7b54d58b8ac1a203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650720197, "uuid": "2dc03f6d-e98d-4f2c-be7e-82df1e235fc8", "comment": "Malware payload", "value": "51d36313db054822b673fc3b0a7f95d205d36e991d48786534bd0aab3fad838f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650720197, "uuid": "2d9fda41-66e6-4a9e-a37f-8ec15d26c74a", "comment": "Malware payload", "value": "f600a943d274640c84d8f7e78bf1ab32d30ecf1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650720197, "uuid": "cb872ef9-64c0-4ee8-b561-ca45b4b9b2fb", "comment": "Malware payload", "value": "3e2885abdb8b97b83a8545ef584576f5a30a4122e94feb942092f7b9a81194fb14394a919c52bc7b0651a28b1fd9b91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650720197, "uuid": "e8e941e1-0981-488a-a0a8-73cae92c9e4b", "value": "T15E25ACB32B547E2AE61D4FB6343B078502F08F65A4C9E63E4D1474D2AAB03DD3526F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650720197, "uuid": "faea1a3d-4823-4e11-82d5-7ef98b34acea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650720197, "uuid": "3adebe4e-8ef3-46ea-b740-8b16d6a678ee", "value": "24576:p5XBdhCNX75ZwmHYh6iiNXBZpp6ARiNXt2pp1NXoC2epfxe803UYkIeknD0PJt+L:wNX75ZwmHYh6iiNXBZpp6ARiNXt2pp1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650720197, "uuid": "aa9948d0-deb5-41cc-a166-dfa7bba3b83a", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650720197, "uuid": "c7fdbf10-628a-4ace-9175-689d97b35eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650720197, "uuid": "eef242d5-3d2e-4c17-830a-cb4787ea433a", "value": "RFQ-20222304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48e907a-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650680729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680729, "uuid": "d5f63c84-9058-485e-af2e-b38b3bcf9fc9", "comment": "Malware payload (Heodo)", "value": "f68f83a56e17ddda1d02a55534f21de2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680729, "uuid": "c4bb5950-90b4-4673-ae02-ec8a9dfdf733", "comment": "Malware payload (Heodo)", "value": "5210ae1341a1e08c1fc93a0ab45b84544644605c3fba4082ce2fb2c0147ca073", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680729, "uuid": "ef34ea45-e95e-476f-a312-fccad5526236", "comment": "Malware payload (Heodo)", "value": "0aadc5e3b3061bc84b4d4ee3a703680b861c3e28", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680729, "uuid": "e202e3e6-e7cf-45b6-b03b-c0c99461c054", "comment": "Malware payload (Heodo)", "value": "5fc84e9edce9a99617606daddf2600c55a07295c5ca6ad2ec25a03432bbb471c1bcfe15bfe256ae2373f0fb5c2f5af90", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680729, "uuid": "79d3c9bd-c132-4e80-8932-e90f6b7bbef9", "value": "T197D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680729, "uuid": "996bf01f-134d-4bf4-8441-513a462b2ad6", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680729, "uuid": "f61082b9-81d9-4410-b7e0-f4a7eee90006", "value": "12288:C1FIcocJwMTHzXO7N2+BHiyzskF1CubVnmn:tco9MTHzXO7ND/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680729, "uuid": "bbae8867-a0b5-456b-968d-3bcefb90fed0", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680729, "uuid": "3c4ff08b-e711-4088-b402-80e33295e19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680729, "uuid": "e6314413-1ee2-46e6-9acb-8e6985a724fd", "value": "f68f83a56e17ddda1d02a55534f21de2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6505bea-c2ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650709562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650709562, "uuid": "7202ece2-a1e5-4dd6-bed9-ed74b215275f", "comment": "Malware payload (DCRat)", "value": "c17956f4fd8791fc8535c353ac48e172", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650709562, "uuid": "01703065-3050-4dfa-9348-91e5d49cb812", "comment": "Malware payload (DCRat)", "value": "52454dbf98d4eed3fe5f26c6139f74c5d858499b7e73040b57186311dc46e92a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650709562, "uuid": "26ae64c2-a1b3-4636-8bce-7d6be247f939", "comment": "Malware payload (DCRat)", "value": "59997c387975d39c8a84653485d92233b2fabcba", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650709562, "uuid": "51db85d0-9e56-4f9f-a72e-a09071ceebe4", "comment": "Malware payload (DCRat)", "value": "a79ab6d554d2f1b982df569888b97a8d86cc17b492d8cca07b9180a90ca64935fbce97c281be951952189765ba8964e9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650709562, "uuid": "125ee525-912c-4d9b-9e16-892e1f615f23", "value": "T143658C027F40DB12E0A45237C2EFDA5843A0ED456AA6E31F7DAA336D15017A77C8D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650709562, "uuid": "95edd033-3a17-43cf-bfa2-8e35bb5fd28a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650709562, "uuid": "5eb443f5-89b2-4731-9bc2-fb8fb60506e2", "value": "24576:klmyJ5FqJipBpreVaMkk6wjjvhHP0cXM3BVc7cDsue:lyfxp696wfecOVcAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650709562, "uuid": "71fb7c85-e6e1-4de2-9f95-71e5df452aa7", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650709562, "uuid": "1fe9f0a5-8d5a-488e-97be-de7cdffbc575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650709562, "uuid": "49f5dadc-de9c-4ac1-aa1a-9f5e2532db52", "value": "c17956f4fd8791fc8535c353ac48e172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60eb382-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZLoader)", "timestamp": 1650734499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734499, "uuid": "88118cf9-b271-4bca-a011-e478421a6f63", "comment": "Malware payload (ZLoader)", "value": "3fcb09c482a4c829188199a43cbebeb8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734499, "uuid": "851eb728-c7a5-43ff-ad50-f68d868181b2", "comment": "Malware payload (ZLoader)", "value": "53c67dc38c386b8a2d8639e2f7b30957436953cbae0ea7f804c9f07cf3021f06", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734499, "uuid": "1097e40b-0e5d-4f9c-9067-bf2461e22929", "comment": "Malware payload (ZLoader)", "value": "7f6a4b30df86b7c9a08dccb272acdcb3aa8dc47d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734499, "uuid": "28eee087-d798-4e30-854f-782afe58f614", "comment": "Malware payload (ZLoader)", "value": "106e61d123524b61c58f7d8795604878aacb4d28a0b0363eede501bdade70135b2a162a702dd8c17444361285aa43ac3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734499, "uuid": "7db48e9f-dc5a-486a-aa14-644efe883183", "value": "T1B3F251F7FB96AC66CE488379486B47906713EC51576B838B3345F7263FB1BA08902187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734499, "uuid": "dfdaade1-2aee-445c-bd16-6f6e21fe27c5", "value": "768:nPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJmhErurA04RpyvYnWP:Pok3hbdlylKsgqopeJBWhZFGkE+cL2N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734499, "uuid": "4b7ae767-0440-417a-b082-203cd621c6c4", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734499, "uuid": "997989d9-76e7-49e0-b4f2-d19a5a40adff", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734499, "uuid": "91c78954-ebb6-438c-ad45-e50f46da2543", "value": "construction.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a12677-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672105, "uuid": "f55fcc62-5e37-4788-babf-66272a113606", "comment": "Malware payload (Heodo)", "value": "cc129040eb2ee755a9c80f3b2896afb5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672105, "uuid": "f198b566-3aff-45d8-a921-b12a4b35b7c2", "comment": "Malware payload (Heodo)", "value": "553ee3d166251f082e1e18874a5c04a60dc1a8b48d0028a1e322e9d199028a6c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672105, "uuid": "da5ab2e0-edf3-4b42-ae6f-2649a5a068c2", "comment": "Malware payload (Heodo)", "value": "5970136151f40d223b18c7a863d7d1b50fd0d369", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672105, "uuid": "4f15dfc8-55c0-4586-8473-b66cc00483c2", "comment": "Malware payload (Heodo)", "value": "cae9c662c5b808bf4e3c1c800fbe7700e1ee6f375e6b2be121f568a9ff17fed87dec858632aabf83bd98fa0bf75e3848", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672105, "uuid": "0d725ea5-dae8-4c7e-90e1-c6f961197bcd", "value": "T1ADD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672105, "uuid": "58821c45-be85-4ab3-8289-db6f9c1cbb1d", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672105, "uuid": "026f51c4-6a90-4f08-849b-d0fb50c5b0ba", "value": "12288:C1FIcocJwMTHzXO7N2rBHiyzskF1CubVnmn:tco9MTHzXO7Ni/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672105, "uuid": "4c6eef90-a5df-477b-aef0-3018cd2a369b", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672105, "uuid": "74292019-8baf-47aa-a9a6-e3e594b5f37c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672105, "uuid": "c3b2d912-e2aa-42c7-8ed8-a8a6a2f778a0", "value": "emotet_exe_e4_553ee3d166251f082e1e18874a5c04a60dc1a8b48d0028a1e322e9d199028a6c_2022-04-23__000141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac96bb1a-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650680742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680742, "uuid": "e0ae5e36-376c-447b-b308-910a8cf4ab5c", "comment": "Malware payload (Mirai)", "value": "e0698dc432b465a4971f546a8d57ce7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680742, "uuid": "4fe2c2bd-6492-468b-abe8-0fe2036c177d", "comment": "Malware payload (Mirai)", "value": "566d4c495f5b8f62d90f28bb9c029831b311a9cb415dd1aa7dae6236ec68e33b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680742, "uuid": "31f24250-1abf-4d23-9d59-ebeede8f172c", "comment": "Malware payload (Mirai)", "value": "fe12f0b434906c91f9aad7260a053f7033206846", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680742, "uuid": "c670a990-7da5-44d7-9915-cfc070afd9c0", "comment": "Malware payload (Mirai)", "value": "c41e5dbfe13c82cc8b3dc922b031d93c939232ac66f41bf32749748df26fc060e2e05984a1061997ebdc334f28de8f49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680742, "uuid": "d77bb345-fe4d-48b8-a513-7ad4c1f2a8b0", "value": "T102D2D0681D2806C6D938F8BC67E563597D6835D6B242CC1E9408AEC3CB5EAEC1A03BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680742, "uuid": "2c7f9e7c-c1b5-4ff1-986c-9bd2d82e1003", "value": "768:q7W9lR3h4CibL1/yGgFVSYF41nDn3vJJgGlzDpbuR1Jr:a0r1KJBnDnzVJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680742, "uuid": "cc62b12a-92a0-4e95-bcba-668215169e26", "value": 28924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680742, "uuid": "ebe5baef-d90e-4d6f-bad9-7051c495cc1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680742, "uuid": "8518dfdd-dd6b-43ed-9e65-f2fb33cb2a2e", "value": "e0698dc432b465a4971f546a8d57ce7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbe7a98-c2f8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650713282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650713282, "uuid": "abb70bf7-5ad2-48b2-b7f5-fc78cabdada0", "comment": "Malware payload (Formbook)", "value": "d382db9d903f52d9f2f7eb2c1039b824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650713282, "uuid": "027b6819-2e76-437f-b0d0-07a2cd9c9d67", "comment": "Malware payload (Formbook)", "value": "59552104d4bb2bcc6518dab735dac7dbb731a988dda8b82d39fa10911e7b8ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650713282, "uuid": "3d304c2d-8a54-475d-9289-a716a542876a", "comment": "Malware payload (Formbook)", "value": "c2e97ed52203259715f51ee9844176e18ea2cbbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650713282, "uuid": "193ae7bc-21a7-4047-aea9-1198b2a8dd90", "comment": "Malware payload (Formbook)", "value": "7da95266b4656b9311c55b74a11c87ebc5ff6ed8debe06800379e8445a671f49563e433ef917d86b0abe897ed13ae0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650713282, "uuid": "4cda8a66-e054-474f-8650-96c45a80ab9f", "value": "T1761412506168C833FAF76A33697B57676FF9850861E0761F83112E1E7D32182C96FB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650713282, "uuid": "20131cfb-4a41-4c69-b880-a305c95558ff", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650713282, "uuid": "d5907af6-3399-405d-937c-e4102c676271", "value": "3072:l1NjcVVnLpPunb+LUXIWURBHaznwK9l56h8bKItm8jHE0t6uCc2gVLpe/FvH/7x5:HNeZmqWURB6Eqvxbpm8DEDrcPVL81D3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650713282, "uuid": "6632263a-5d17-41d1-a3fe-587fcf12913e", "value": 196653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650713282, "uuid": "4a936fb3-ee54-4376-b9e3-6d74109321b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650713282, "uuid": "4db41c3e-a360-4230-a857-22a2e5bedbb6", "value": "SKM_1504322RS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449fa202-c2f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650711062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650711062, "uuid": "39881980-363f-46de-856b-ac3168c593ab", "comment": "Malware payload (RedLineStealer)", "value": "ab42ee8101b171c010f1a0d0a76b67e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650711062, "uuid": "d58b46f4-79c8-487c-b867-b7c04042e908", "comment": "Malware payload (RedLineStealer)", "value": "5e23006ab9779ed10524ad2993c26cd4e0e5d0463631af5631a597900038a809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650711062, "uuid": "00521a8c-e72f-4b9f-b2b3-dee948b856fd", "comment": "Malware payload (RedLineStealer)", "value": "0da3e5c2da63d03c52b5e47065b8b7a127facba5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650711062, "uuid": "9e3ce06d-2841-4456-92f6-f467724f8012", "comment": "Malware payload (RedLineStealer)", "value": "891b8568ab584c029811c7c7b6d08479deee8e5b393e836a61e699b46411fdfd91e8abf87d2d7fe0569265c95cd8b5b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650711062, "uuid": "6af89a53-4481-480f-930b-6752aa32ae33", "value": "T1EC64F11076E2C433F0B296735935A7A59A7E7FAEA630540F335016E82F701C18ABD7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650711062, "uuid": "10cb95dc-896a-41f2-9bb4-701660c0a168", "value": "b7552d5effe5c4c3a2172befeeff5e31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650711062, "uuid": "dedec629-5246-4b20-b41e-1311865fbb89", "value": "6144:KBUiZJLXoFnG7sWKNwtAqIb6uKdF0RAD6hHKei5H:KBUiZJjunoKNwtQeF0isHFi5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650711062, "uuid": "c93f0554-27b1-41f7-b6e9-a10d4eaca8d4", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650711062, "uuid": "a7447c67-07c1-4738-9c6a-cd4c5cf9ba10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650711062, "uuid": "1214ddb0-6ce5-4849-a766-bb4aa929b376", "value": "ab42ee8101b171c010f1a0d0a76b67e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ad20b6-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650674563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674563, "uuid": "c00164f5-f926-4aff-ae35-f05ecf408fef", "comment": "Malware payload (Heodo)", "value": "30ac50f650ff438d2a1d29d2ed588324", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674563, "uuid": "178a30fb-e181-4409-87e2-8986e1089c5e", "comment": "Malware payload (Heodo)", "value": "5e7100f292df36d8f65845a667f3238a11b642596ad1ecdb69741c06e5f48cec", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674563, "uuid": "42a7c047-1812-4208-a0aa-29b5e9ce67d6", "comment": "Malware payload (Heodo)", "value": "96616366ac5b521fac76119d5ad7b1c9ec65ebc9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674563, "uuid": "dd9fc5f0-b63d-433f-b248-c41f1d3328de", "comment": "Malware payload (Heodo)", "value": "6c42e2280192325a4b2b07eb5341423dd01462df78d5bb201b863b78c69837e730b525e02b426bf4527764835ffbfce3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674563, "uuid": "c04128ac-7230-4caa-878e-e75ad4383552", "value": "T1AED49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674563, "uuid": "d530c454-5bc8-4686-9889-904f440f5a65", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674563, "uuid": "71d8af8c-b8ff-4682-b75f-43269c6600a5", "value": "12288:C1FIcocJwMTHzXO7N2HBHiyzskF1CubVnmn:tco9MTHzXO7N6/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674563, "uuid": "a39249ab-21f3-41e9-809e-0c7a13aa150c", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674563, "uuid": "b20366a2-ce13-41b3-8769-dbd9439466ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674563, "uuid": "ff80a85e-bca2-4363-a754-288ffe2d6f45", "value": "30ac50f650ff438d2a1d29d2ed588324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8428d30-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650693647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693647, "uuid": "9fd9014f-b26b-4979-b709-773c10b5db27", "comment": "Malware payload", "value": "7180981c19d91a50ab18b564f8593b77", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693647, "uuid": "06d194a5-0c0f-4a30-91fb-5765ee63a4fe", "comment": "Malware payload", "value": "5ec3efddd53e3321612be56d9e5567f60ce434e054b099f7b1ff7194cc562c52", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693647, "uuid": "66144fee-f0ed-4d11-956f-8be3e812d5bc", "comment": "Malware payload", "value": "082502648494ae76eb03811bd9b8adf4eaa6dcca", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693647, "uuid": "433d38d2-15a3-4cd5-a590-ad3f036a68f2", "comment": "Malware payload", "value": "21e10e20e6ba270ff63d86c02181b741144c1e7d4beb2bc6f4f89a0919775b13e3c16f5b366189733f170eaca609bbe8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693647, "uuid": "f0772f33-023a-4743-b0b7-a713f9beff44", "value": "T1E204ABF72D92E214C35B5421806D0A4F5FE5F8768C328871D8169FC2DB3DE7B24A6C8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693647, "uuid": "cf67b8a8-3a86-48d3-b5ce-2bad532001d2", "value": "192:6IQ7M37SAyDRylQY+4pyKzTypz0yPoxOyzpaN5oxOyzpN6NTyUKcPp9yIpNY+4pf:VQwSJ9EwNWOhoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693647, "uuid": "5c106333-567a-4a54-9e70-d51bc8080d5b", "value": 176605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693647, "uuid": "ecdcba07-2b74-4561-8c5a-b0f6de6cef34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693647, "uuid": "57314744-2617-4373-ab69-c1e1f7f7572d", "value": "Info_Releve_ID0021508.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1047d786-c299-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672320, "uuid": "39fd9c3e-0aeb-473d-9c0c-1143e84ed023", "comment": "Malware payload (Heodo)", "value": "10604bf03a27b7fb54a61e2f7ae6639d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672320, "uuid": "c9097fe0-13d9-4bd9-ab89-897b90a913de", "comment": "Malware payload (Heodo)", "value": "5ff2d65fadd7bdd9e8d23c1ce0a5de1a0fb96404f6171d4f2540ac6f8f2442fa", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672320, "uuid": "a24ebf14-81ce-4965-b9fd-d230babf6950", "comment": "Malware payload (Heodo)", "value": "a313f44bab5d33c5f03a047f2f571eea55289f71", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672320, "uuid": "7672dcc8-a1d9-4002-893c-9becb1bc3000", "comment": "Malware payload (Heodo)", "value": "1795b72c718dc7223de9249761f969d938b3b3ad99b04827633a9537a223d9c7a873cf4f4ce17addbfeca23f6917b121", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672320, "uuid": "0e45948b-f27a-4ee8-a22d-8118d7a7e47b", "value": "T172F48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672320, "uuid": "5d1c4de0-99e6-4619-af76-172120b357af", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672320, "uuid": "94b6103e-001b-456e-ae03-631ee25a75c8", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjMi0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjhT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672320, "uuid": "d82287bf-3aa3-4d81-a2e7-79e2cdc40257", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672320, "uuid": "0797614a-8a62-4185-86bc-68677e672614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672320, "uuid": "e19b2d93-69ff-4a4b-8f59-1447b137d9d3", "value": "emotet_exe_e5_5ff2d65fadd7bdd9e8d23c1ce0a5de1a0fb96404f6171d4f2540ac6f8f2442fa_2022-04-23__000513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56725e8-c2c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZLoader)", "timestamp": 1650690179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650690179, "uuid": "2a0eaaea-4068-4c5f-a3b8-47342e5c6e41", "comment": "Malware payload (ZLoader)", "value": "d034fa1ee4a38843ec0f38fdbea9a2a3", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650690179, "uuid": "6ba3a244-4c41-4130-a96a-87c4600d476a", "comment": "Malware payload (ZLoader)", "value": "61bde51a5850f88445963e753a20a5d75a894af4000c488bcae03d94eafb37a0", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650690179, "uuid": "fa34bcd8-9e34-4cdf-aaf7-3177ae86bef5", "comment": "Malware payload (ZLoader)", "value": "3814d05f3de874689a3c17041db7348021706f2f", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650690179, "uuid": "a41d0943-51d5-4e63-a2be-5237eb2f0a50", "comment": "Malware payload (ZLoader)", "value": "991b64cdf69eb2a7e7ef44b5d10148d586b5e07eda747b33e93f89a407e7a14091ac56b161b46f3c2c81df58102191df", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650690179, "uuid": "bc2da16b-55d9-4e28-903b-e477eeeb8eb5", "value": "T1DDF2A3F3FA95EC65CE088335486B8290A713EC51576B938B7385F3263FB2BE0490614B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650690179, "uuid": "9d3fccb8-b0cd-413c-b1ca-8f5402c596f8", "value": "768:EPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJom/n1WWnrxO:gok3hbdlylKsgqopeJBWhZFGkE+cL2Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650690179, "uuid": "5cefc35b-5bfb-451b-9f67-dc5a229901e8", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650690179, "uuid": "bcb96590-6e2a-4e1a-a11c-c801ae61bfb8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650690179, "uuid": "25c21bcd-34ab-4d48-bedb-d79fea1e4c7f", "value": "ASSASSASS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc6b039-c2cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650694008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694008, "uuid": "5011d497-6afc-49da-92c6-a707f26e9d6c", "comment": "Malware payload (DCRat)", "value": "9648a5c08366b431006bcf1591f441dc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694008, "uuid": "6e217c67-d2e2-45ca-aece-f14458926b32", "comment": "Malware payload (DCRat)", "value": "64ae5410f978df0f48dcc67508820ea230c566967e002703c23c67088883b3bf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694008, "uuid": "487e7c21-7927-4120-914a-05676f208b8a", "comment": "Malware payload (DCRat)", "value": "4c6d186bea7a135d5c518c4dafe1b6593c81b336", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694008, "uuid": "19d927ff-65d1-4cee-a053-e0d396f69a62", "comment": "Malware payload (DCRat)", "value": "cfd4ecedd88b057375650a7078ea5f4744500e97f959308049f3979964bc137c7a91d28f936782e3bd96fe40a9299b04", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694008, "uuid": "41d76142-ea97-4bdb-b81e-eb510394a4fb", "value": "T130C209DA7B9CC567D6198A3EDC97C5480260EE0BA813C41B309A374F28727D9DE057ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694008, "uuid": "354e9f3d-2540-451e-97b5-a0538c8383ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694008, "uuid": "0440e123-cbc1-48be-ad9c-6dbd7fde0fc5", "value": "384:mNINl2zwX7auEjDtWwkcJPdK4Elw/Kb/j0edK0N6uQtJVxhYO7ueG:WelnW6CBMxb/z3eVJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694008, "uuid": "4e8848c1-8b76-4467-9a62-3abf39e62bd3", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694008, "uuid": "88e3bf17-c58e-4e54-8b26-27db847069a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694008, "uuid": "fc868ed8-7141-4282-88cd-2d88b8333e99", "value": "64AE5410F978DF0F48DCC67508820EA230C566967E002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d7d2cc-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650674580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674580, "uuid": "ce5fdf4c-7d95-4391-b41f-b28874eed577", "comment": "Malware payload (Heodo)", "value": "26a588908930da26259a94c4d99fdb71", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674580, "uuid": "2f485e1b-0607-4a7d-a2e9-8bf9dddd4ef2", "comment": "Malware payload (Heodo)", "value": "65099313d7521af874a57dfbe871b5f24f31eb6c1315220c7ae145b692262751", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674580, "uuid": "4bfe4b25-4523-481f-8b87-52a78e207031", "comment": "Malware payload (Heodo)", "value": "cedc210980fbfac10b962f06b9d51193cbfcfad1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674580, "uuid": "ec05c079-7107-4b10-959c-6eec3ab3181e", "comment": "Malware payload (Heodo)", "value": "aef7bc7fc3bd884a895492c9c76358508080898805c0d6134d4ca7262ca10cf0dd5a802caf12a4eb4f476c3cd24dcd06", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674580, "uuid": "5c3ad0ef-c7a9-46ae-8e97-b22f2cf8c165", "value": "T1D4D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674580, "uuid": "7de463d0-d1da-44b8-8938-c0d51b03eeb7", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674580, "uuid": "bf0eea6e-8223-4c72-9f12-c1e11000c36c", "value": "12288:C1FIcocJwMTHzXO7N22BHiyzskF1CubVnmn:tco9MTHzXO7ND/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674580, "uuid": "44426428-3892-4a5b-96e8-caadf2ef86a9", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674580, "uuid": "cee4a014-d469-4a92-a42f-23240f1296c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674580, "uuid": "d9139c36-b094-4685-8fc5-94491b050c08", "value": "26a588908930da26259a94c4d99fdb71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8963ae-c356-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650753599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753599, "uuid": "5619c805-ee57-4a3c-a225-d159bdd7de20", "comment": "Malware payload", "value": "c6ffe77633699ed29481544c7ae6c2c8", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753599, "uuid": "af6f26d6-fc45-4d4b-afed-82a57a5954ec", "comment": "Malware payload", "value": "67b1c8fa152148f29fead397ce988d47ca665cb3a2dd93fe57a3fccec295376b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753599, "uuid": "bfe570a6-358e-4ed7-8366-309600c7317d", "comment": "Malware payload", "value": "5c8a71f85ae99d82e794a278156d9e88ee575244", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753599, "uuid": "c028515e-1380-4de9-a2cc-640302126868", "comment": "Malware payload", "value": "d72c6d2e7c1167e6455eb656c31cbf2925707cc028fa39987d29f51430a10b9dec78b9afb33b1530fc89b082631a0152", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753599, "uuid": "b5a6310f-823c-499b-9895-2de3bbed75fd", "value": "T1E77723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753599, "uuid": "a671a803-0689-4ac4-b923-62239d78371d", "value": "393216:xADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8R:xAwwU8SAwwU8SAwwU8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753599, "uuid": "7e814b08-47d9-4ea3-b463-ef74d6469062", "value": 35821568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753599, "uuid": "d1b02197-ff22-4d7b-9bfb-c09f56def96f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753599, "uuid": "18c176d8-b826-41d9-b018-b5a86c8a60ac", "value": "Windows11-setup_11.80807.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51ea698-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672193, "uuid": "89396526-864b-4e80-bdc3-357c173ac783", "comment": "Malware payload (Heodo)", "value": "c3ac9960714e1a0fc915ed0123025718", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672193, "uuid": "bc1de482-5dce-47b3-b409-59add6eae2c9", "comment": "Malware payload (Heodo)", "value": "68291fc04a88713ddac3227fe88d0dae3a841c2f9469a5d9b76b67451406c52a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672193, "uuid": "0d6057c9-2237-48f7-95f0-b265758cb79f", "comment": "Malware payload (Heodo)", "value": "9b58e1c7c547b1300ed66ce4f0aa96aa62d01b93", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672193, "uuid": "3e5f9fac-7743-4dc1-a76e-2f78386b0d1b", "comment": "Malware payload (Heodo)", "value": "5f80229f35c264e54fc74dcd3b2caf45d87c4bef0d7369661f37fdd398c401802497bfeaca02f270c73dbbdaa69031c5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672193, "uuid": "d0e35de7-6025-441c-a88d-f80cbdb4843b", "value": "T195C46C11F6AC80B5E07BD13DC9A3865AE6713C984B7943C79251EB3A2E736E15D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672193, "uuid": "24fd1476-e60a-4e47-bb81-5e89527993a6", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672193, "uuid": "391a194f-6835-4233-8b7a-53a1cd9076f0", "value": "6144:1oJyHSfFIDAqBcJ6EkVgNazgHH6mXZOs4z7N9nAqieHiL7iinzGCvCsP5Ot2:C1FIcocJwMTHzXO7N2qBHiyzsk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672193, "uuid": "c5e736df-d202-47e3-9ee6-a0cf5503ba23", "value": 547132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672193, "uuid": "0b8d440d-478c-4e86-80bb-0ce4cbc3fd9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672193, "uuid": "d6760c72-53cf-4ffb-bf96-259eadd03275", "value": "c3ac9960714e1a0fc915ed0123025718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc5e0b7-c309-11ec-8e58-42010a9c0032", "comment": "Malware payload (Joker)", "timestamp": 1650720503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650720503, "uuid": "1cf36537-fb26-4c49-825a-ec79d9f321af", "comment": "Malware payload (Joker)", "value": "663ab120d06ec2faf867102f19b611ca", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650720503, "uuid": "add3862d-c06b-43aa-af39-f1605fd0dad0", "comment": "Malware payload (Joker)", "value": "6850a0aa9dea97a0262f11f92ff1d33d653b43671c55648dc8fd3e9e3aa22a8c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650720503, "uuid": "7741fda3-da27-4a83-8c90-4f7338d2a7fc", "comment": "Malware payload (Joker)", "value": "9dcda8a2a015a50b7c37574bcc0c821934083de2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650720503, "uuid": "4efa82d5-6ee6-4228-a3be-3c8b5f826336", "comment": "Malware payload (Joker)", "value": "a5b86c03f24a88ea5625007db3a6fd8b2029a937dbc31254cf25264b0f5cd7dd269288f4e1554e1909198ee00cea455b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650720503, "uuid": "b42b0ec1-99a3-416c-851a-b287d2000f9c", "value": "T181561287E30DA86FC9F759328D7A422602670D2945839BD72D44722C6DB7AC05F9EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650720503, "uuid": "b1bcaed7-081e-4338-851c-dae6f85f139a", "value": "98304:DfArAqo/RtzwUsykMODdj9VHfeebyWdETg8pAc7jBxQAGWhIEn4x+xvzfr+VqAL:DfAr1BMe/xy5Tgpc7XxIK4x+xkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650720503, "uuid": "01cf5eb6-8af1-402d-a4cf-9095e6aacfda", "value": 6361976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650720503, "uuid": "8d08a72b-73b9-4794-9106-bfcdb537fcd8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650720503, "uuid": "3101d76f-4ac3-4f83-87d0-c0582d68893c", "value": "com.outcome.bloodpressurediary.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc808a63-c2c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1650693332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693332, "uuid": "443e7f1f-0e05-4b0f-b737-c1af86bf3730", "comment": "Malware payload (CoinMiner)", "value": "df0a0a86a2d9ea5e316fec5a3eb8ef93", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693332, "uuid": "bd7fdf2f-d8fc-44ee-9c9c-4bf82d3332ee", "comment": "Malware payload (CoinMiner)", "value": "6d07c9f7e7a8f71c8ff9d0d752ae237e9f854c916fddf6b02d5705d73d43adbc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693332, "uuid": "b38f32f1-9404-45ad-aa8b-91fa7169637e", "comment": "Malware payload (CoinMiner)", "value": "e3def596ec1910b321039d7135bf91cc3fd663b5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693332, "uuid": "56a79906-7f16-4135-a325-e3a957eb2331", "comment": "Malware payload (CoinMiner)", "value": "a134609ed746a9c0f6f8d78a5c0b94b0ec18fb5581c0c5cfe0e92ac4eab0cf9bc20f37d76ef961ab95c131f9e055fac2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693332, "uuid": "14c7170a-ec84-436a-8687-d9bc1948e476", "value": "T139E502BD628433D8C41FC8309523FD44B3F6651E5BE496EAB5DBFAC06F6E8109902B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693332, "uuid": "f2d62122-5e4f-49c3-bea5-9e0bc0db155c", "value": "4e4095a0d90406c8428c5d9a9c6b05b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693332, "uuid": "0cc3e766-744f-4c47-964d-14674c57a09e", "value": "49152:uWp40VJCghLUqaS+Zn63bnUYLEbHDXKjXkzljwXDonYiWzIpg/VbWLKzgDNfM5WI:uYIQbTLgH+jXKpcdiWqg/VOi5qIneX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693332, "uuid": "047d9a49-db71-4a97-a1e1-414121302e7e", "value": 3284424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693332, "uuid": "6fd8531f-8048-4a49-ad9e-998ea7ec2e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693332, "uuid": "ff6fcd49-daa0-470d-8e0f-7bd2994d636b", "value": "df0a0a86a2d9ea5e316fec5a3eb8ef93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3ef74c-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650680770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680770, "uuid": "0b5a4e61-85bc-4a1d-aae5-1a3a864bc20b", "comment": "Malware payload (Mirai)", "value": "b3216c08ace33ffc876d24eba2537291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680770, "uuid": "2a6e383a-90a8-4a54-a6d9-ce380dc3d307", "comment": "Malware payload (Mirai)", "value": "6e92c25afffd94ba5a3e42775338f9deda7c13e3cfafaa712cafe74effec5567", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680770, "uuid": "14aa69ad-60dc-4c4a-8928-8ea5f48db0a1", "comment": "Malware payload (Mirai)", "value": "aa389377cd4edb0fd3ee798653ad415a39a6ba32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680770, "uuid": "07ec344d-878a-447c-b152-b93afb9eecc0", "comment": "Malware payload (Mirai)", "value": "19381bd63e3ea2aa091122e0280a9a2fd216a13fd64d452baff2dc7e59008a5dc08feeac4774c45cd28c71a4074e107f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680770, "uuid": "0505cb79-d2a3-45da-b918-86a7624e84c2", "value": "T1E1537C39D459ADE8C0064A74B819CE345F53E48483A32EF6DAA083EA9453DBDF419FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680770, "uuid": "c62f7622-68b5-4a0f-aaba-75f2710caa73", "value": "1536:Lan3rst5CCFjwtV3W69e+wfs3y7pI/q+LKyeqCM:Laot5CCdoyf+yNWLKyeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680770, "uuid": "2e3909fa-4829-4814-8021-fb0419be78ba", "value": 65044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680770, "uuid": "64989b80-2d4a-48ce-b5ef-dc9a16149edc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680770, "uuid": "468417ac-fdb1-4fd7-9db7-6f0fbfff3ec2", "value": "b3216c08ace33ffc876d24eba2537291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b52adc-c2d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650699598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650699598, "uuid": "0cc10630-69a2-439e-a7b0-2ea3150fde10", "comment": "Malware payload (Heodo)", "value": "d538498cd84e0bc1aad2f520533dc547", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650699598, "uuid": "31ce749d-7b7b-4071-ae9a-85752fcdc320", "comment": "Malware payload (Heodo)", "value": "6ed033cc939a8af3ecf5f4e52bf3c35478c19c6100d457222b1996509ca8a7d7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650699598, "uuid": "12bfcd2e-a9c4-46f5-b9ba-d11f59b39d01", "comment": "Malware payload (Heodo)", "value": "ce9620fdfb6904c8492bd8e51a377ce5ab39ff60", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650699598, "uuid": "120fb0ab-cb2f-4afe-9a95-b0b5020ad3f2", "comment": "Malware payload (Heodo)", "value": "8e3578f491ec08ac6edb0d2cae06c51257faa4271b8796278222fc9a04fa7c65de0fe31a5631052828bba7d38fdbb605", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650699598, "uuid": "3c90d290-6e70-4953-b31a-cf3068bfc7c0", "value": "T194D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650699598, "uuid": "320e21b6-34d8-40e1-9d34-3d3e9d8b0ce2", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650699598, "uuid": "098f281f-8623-4f46-b158-8151aab53b31", "value": "12288:C1FIcocJwMTHzXO7N26BHiyzskF1CubVnmn:tco9MTHzXO7N3/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650699598, "uuid": "6f4a827c-fe08-41c5-a3aa-e9689da98686", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650699598, "uuid": "5bdff0bc-95b8-4c71-9ad8-4b577d64b57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650699598, "uuid": "8f34d320-3ebc-4c5f-9e55-f9b05c1c0fa0", "value": "d538498cd84e0bc1aad2f520533dc547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1283f2f-c2b3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650683837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650683837, "uuid": "65ac539d-3bc0-489a-87aa-ec88d580a3bf", "comment": "Malware payload", "value": "93655897a9a998e8d2fff4cc3e62788d", "object_relation": "md5", "Tag": [ { "name": "code", "colour": "#30CFF8", "exportable": true, "hide_tag": false }, { "name": "source", "colour": "#53C55E", "exportable": true, "hide_tag": false }, { "name": "varal", "colour": "#7200EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650683837, "uuid": "791950ca-724e-45cd-80f3-d0a614817f47", "comment": "Malware payload", "value": "6fdc359a8c4e3a12cc185943822cbdf1efc12456951b00c077d07d0976c2e85f", "object_relation": "sha256", "Tag": [ { "name": "code", "colour": "#30CFF8", "exportable": true, "hide_tag": false }, { "name": "source", "colour": "#53C55E", "exportable": true, "hide_tag": false }, { "name": "varal", "colour": "#7200EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650683837, "uuid": "f4ab0e02-a288-43eb-a9b1-e2b73e8a8b5a", "comment": "Malware payload", "value": "61a92bc92f7fccc7c434e980108165e0a642f3cc", "object_relation": "sha1", "Tag": [ { "name": "code", "colour": "#30CFF8", "exportable": true, "hide_tag": false }, { "name": "source", "colour": "#53C55E", "exportable": true, "hide_tag": false }, { "name": "varal", "colour": "#7200EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650683837, "uuid": "72c2118b-b239-4ba0-915c-af04d1be0964", "comment": "Malware payload", "value": "3ae8098993d1cae0648ae798a3fe9606c0e49097a33f94fb956389a0d48e86b7c2753ed6570ef8a5f1b41d51d05e4901", "object_relation": "sha3-384", "Tag": [ { "name": "code", "colour": "#30CFF8", "exportable": true, "hide_tag": false }, { "name": "source", "colour": "#53C55E", "exportable": true, "hide_tag": false }, { "name": "varal", "colour": "#7200EB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650683837, "uuid": "ecd552da-a52e-4822-8212-216762383f70", "value": "T17BD13407BB0DC36BC172726E2156840ADF71A3AE31A09348DDF8D64A4706B6D4FD9CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650683837, "uuid": "11c223d3-cf02-4aa9-a503-426f8f62f86f", "value": "96:qgl1Uo0T0TIs4Ef4EkFWAnFeYAQcw48lomn683o0dve7Rj1K30AtVSGwqJX8ZY1h:lfkZb48lomnn3o0teI3G/ZTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650683837, "uuid": "42b25816-30ac-4af5-8dcc-7e8dbb4d4df4", "value": 6410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650683837, "uuid": "fa4c65c9-63fe-4cbe-8447-bd378ba2e3ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650683837, "uuid": "2e17b46c-403f-4355-b020-ce99df5f2ccc", "value": "Trojan.Script.Suspic.gen-6fdc359a8c4e3a12cc185943822cbdf1efc12456951b00c077d07d0976c2e85f.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f704172-c356-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650753493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753493, "uuid": "4561590f-89b7-4c3c-b1cd-76320fc38565", "comment": "Malware payload", "value": "8b6b26ed3554e71401fa47ad32077a05", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753493, "uuid": "1c1ba5dd-21d1-476b-953a-ccb267589d0e", "comment": "Malware payload", "value": "6fed1724644d8e5b5dafc818a93d324f358d3d242eac667a610a68318687db31", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753493, "uuid": "4d207df7-1ba9-43da-828a-9d1ecd6949d9", "comment": "Malware payload", "value": "79fae3838c9dc18fad044f0dbc9022dd22b91203", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753493, "uuid": "af9af7eb-1430-4c9a-8e62-0deae500552c", "comment": "Malware payload", "value": "7cb3bc699e853804bb6c4851843f848a664b3a6ab4f6fd51d5a647c709b347fa9fe875aebfd82dd184d00d695c576c2e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753493, "uuid": "33c16057-5864-4ac7-b11a-e500afc1769c", "value": "T1347723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753493, "uuid": "864e131b-1c52-4305-aefd-a8a3e0b4c4ff", "value": "393216:+ADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8c:+AwwU8SAwwU8SAwwU8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753493, "uuid": "c46e1730-9158-4cbe-904a-23fb4acf06ab", "value": 35821568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753493, "uuid": "6151dfab-8cd2-4373-a373-f670cc651e44", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753493, "uuid": "23011662-db93-4a94-b447-0395fe90fd9f", "value": "Windows11-setup_11.17632.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539db549-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650734280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734280, "uuid": "035a9e0b-985e-4018-b2cd-9f3cf6c6cf3b", "comment": "Malware payload", "value": "54b18e20ead6c7c4468bac68d1393704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734280, "uuid": "d69ffc92-7105-442c-ba46-7d59f418a5d1", "comment": "Malware payload", "value": "7098502e58a79170ccc66df0965c0e3f948629b42591d94f3d62963c86507044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734280, "uuid": "343058d5-c59e-41e8-ae33-5e33ef620bff", "comment": "Malware payload", "value": "6d112324e56acb483e64c680e998c022b54f6a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734280, "uuid": "d406ce1f-7267-4293-a90f-12a5bea0ad2c", "comment": "Malware payload", "value": "0e39a698d9c1522ac02f7c6c7888e2154cc7c03cf93f8399079b6495c9c3411545390a292728e0e3f5b24cbfe4a561f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734280, "uuid": "275c12f1-828c-4b21-af29-a2b531ce14af", "value": "T1C7D49DE28DA0254EC9659B38E4C3CCB0F9CDE149602E778C747147176E9D3C4DACA7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734280, "uuid": "d770160d-bc9b-4721-92f2-7559996b240b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734280, "uuid": "f4d9a87f-b0b7-44a3-a2d5-4511f54c6cc1", "value": "12288:clJrxTyrImLE9x2lGE4w0atPE6Ui8WJXRdDBCp:cLlyUwlZq6mUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734280, "uuid": "2484c2fd-6776-476e-84e9-8ec3c607e282", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734280, "uuid": "9e815c7f-ffa3-44aa-be2e-36160dccbcec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734280, "uuid": "b262a8e9-cfaa-4e58-922b-90d65abdc8ba", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa512ac-c299-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672318, "uuid": "9fb4f459-71e0-4cbb-9308-8e32c70bfd62", "comment": "Malware payload (Heodo)", "value": "f96b9b4b6dac24affe514cc433b9d013", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672318, "uuid": "a1ec11b1-3250-4001-ade0-1faa41c6a7e0", "comment": "Malware payload (Heodo)", "value": "71caab2fff56d8dc829f428f14d891eb6ee45185def0b0884a4af0216424ed38", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672318, "uuid": "18329646-8b7c-4968-b899-d6cc5982b9ce", "comment": "Malware payload (Heodo)", "value": "a6fcf9341bdbd7fbccdf4e58d0571a355768476a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672318, "uuid": "276ad4f8-5066-4ecf-af72-5776e533f7f1", "comment": "Malware payload (Heodo)", "value": "fdc49a1066667b791d2fadd12f11bd1832715c0fcee01e891b6ff1d7aaa0d862597907df7218dc8e6ed1c68c69fd9b60", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672318, "uuid": "54d7f551-519c-4ebd-adcf-6e1f2f17dfa2", "value": "T11DF48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672318, "uuid": "9fc4c883-ecd1-4418-bd7d-1daf4c62e3c9", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672318, "uuid": "9af7c5db-7e7c-452b-b873-9adc7cd1a1cc", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjdi0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjYT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672318, "uuid": "c43181b0-8136-4c5f-bc8b-ff814deb2bf3", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672318, "uuid": "6014a2ec-a528-4bdf-9c11-57c81c5f1a47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672318, "uuid": "b25e0551-0285-4f8b-95a1-d3bd3ce23fad", "value": "emotet_exe_e5_71caab2fff56d8dc829f428f14d891eb6ee45185def0b0884a4af0216424ed38_2022-04-23__000512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326a3921-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650734224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734224, "uuid": "23f99bac-aafd-4676-8430-c78fdaf33498", "comment": "Malware payload (Mirai)", "value": "25148c409c51dd03b33187b198053c78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734224, "uuid": "9f8d2d6c-9afe-41ec-a48e-882040a8c017", "comment": "Malware payload (Mirai)", "value": "71f32957bc57899d6126436179f29ff8bee89f73b4f021985c210b02114151e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734224, "uuid": "8028c758-1e2c-42a9-bd4d-32dca504bd60", "comment": "Malware payload (Mirai)", "value": "641cfac9b2a4ace21eb130a6027007c70b3bd6f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734224, "uuid": "bbd4d8c4-1395-4c4d-bd80-f1608d2f0883", "comment": "Malware payload (Mirai)", "value": "9a87b19be1635553da0496694f5ca10be41336bd21a493851ae61ce5ad5c610cf500418a7c5a52cc877c7744290fe7be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734224, "uuid": "96ac47be-a31e-44b8-b9fb-9ce4a5741ec4", "value": "T1E9334AC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734224, "uuid": "e4b11545-dd2a-4521-b06a-55420aef6627", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNf6OQ6xpwhNbr/e:xZebkP/Ad39UMJRlhNSL6bIbDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734224, "uuid": "e923005e-1f44-43ed-aef8-fcdc40b3b905", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734224, "uuid": "5b449d8c-20c4-4472-8f2c-0dcaf0e9b51c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734224, "uuid": "65a33463-9224-4d3b-b766-2227f5d2d67c", "value": "i386.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c39c41-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650734248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734248, "uuid": "68b74ee8-2cd2-45d1-b0ec-9df294111263", "comment": "Malware payload", "value": "b9c69a556b09b289b669e324144b6174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734248, "uuid": "ad676b9b-ec6a-4084-85a6-c77e5d773463", "comment": "Malware payload", "value": "71f3c864376ee1a590e2474d06978f1c040a868c1295c273e23190f9cc4f28b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734248, "uuid": "708b3da1-d6a8-435f-8f9a-32c63012e639", "comment": "Malware payload", "value": "db52f21b0ad3c15ab7fb805f57a393c4729f4e96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734248, "uuid": "90c22b6e-272c-4982-93f4-c34331565486", "comment": "Malware payload", "value": "75966316102da4c53f0ddf895f1e103a245ea25ce2c7d1399ec45accbcf3d21e2db7492ed79901b02a986d2a391a3113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734248, "uuid": "14354205-6dc8-4c08-9620-486a31ae7367", "value": "T1BC83095BB61D0BABC59B5BB12CB737F19B69ED6002A211C4A10EFF9007B29702532F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734248, "uuid": "44e796e5-d94a-4fce-961f-a15ee090c7f5", "value": "1536:OhkV/TRBXuWSGixv5TgO07Kq6FUICUHe4zotwHUIe:WuLZfc5Tl0ObiU5otl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734248, "uuid": "bc845e5f-0cb9-4860-a40a-373d646ec2b0", "value": 88583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734248, "uuid": "65fef518-6391-4c29-beed-4e1d798ebdbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734248, "uuid": "80a2b7bc-1a92-4a62-83d7-e75087375576", "value": "ppc.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f61c33f-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650734192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734192, "uuid": "f2547f02-bb20-48a8-aaa5-cd1cb1e5cb25", "comment": "Malware payload (Mirai)", "value": "d507b2ca45e06e6a4da8e8c8fc14d25d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734192, "uuid": "c43d999d-123a-400c-a96a-5166be3ae6ff", "comment": "Malware payload (Mirai)", "value": "71fbbc7ba25b68c8f7490035634ebf891fb3068fe5be82fab62ebc07627cedb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734192, "uuid": "00744133-07f9-4b45-85e0-1698db1ae51b", "comment": "Malware payload (Mirai)", "value": "da18a4825b5e65b9d4067aebc5db32362019f2a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734192, "uuid": "515e3641-a813-411d-922b-a5eefc28649a", "comment": "Malware payload (Mirai)", "value": "82c4b8959a6e4fea202200f939bb1b93a08aea8d31d28fc1c50cf0faf84ac9d4d790fb0e29b95c6ac68c6a2ee7e50352", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734192, "uuid": "50b6880b-3d64-4bb8-a20d-888e6230fd5c", "value": "T12FB31845F8408727C3D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734192, "uuid": "b62161f9-bae2-4b85-9d18-c87a07ae5a73", "value": "3072:MSY+46m1qOzssoFPPKNy+AmkZrQAhPDCXFke:06mgOzJoFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734192, "uuid": "2e8b7731-67b9-47be-a25d-f771661b3126", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734192, "uuid": "f0f969d1-f5b4-4daa-a98c-ae1f883c476c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734192, "uuid": "e21b68d4-643e-49a9-a1d6-509d2f073295", "value": "ax.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391c9e9e-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650734236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734236, "uuid": "a3eae4ac-580d-42e1-82e5-a3ef04e3eb34", "comment": "Malware payload", "value": "09dc6eeb93d38450017ccb017a79c86a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734236, "uuid": "a20c091b-a8f8-4ca6-b5af-8165ba679b3b", "comment": "Malware payload", "value": "71fc8a3f51e3310d14a1094a5f8527be2adb013b6bd53befc69a443eb485ed02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734236, "uuid": "203e0e56-6da7-4bac-8924-a07cbb30cccd", "comment": "Malware payload", "value": "3f47e48d1d0a2d1f1b83321c2fdf9cbf98628d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734236, "uuid": "94cf540f-aa19-4751-920c-edb6b9e3825d", "comment": "Malware payload", "value": "3b48a9c304bcc5a9a34657a4dd844adfd48e410a59ae67975ff4d5f9063e892b62b0668ad03634588ac133046e4389d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734236, "uuid": "f8969986-3fde-41b0-830a-10c606dd353a", "value": "T112D3D717ABA15EBBD81FCE3301E64521109EE49613957B2FB178CA1CF74BA8E09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734236, "uuid": "e2f1047c-4cdf-4541-94c5-d379a5f4bab4", "value": "1536:16ejYDS8RO+hFWUQdYwurvqpucAxMDq0ndkm/nBgvJYy0h:1Ie+7WdWmVmMDqmkm/BgxYy0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734236, "uuid": "45247f05-32b8-4092-948d-8910b5e0d55e", "value": 140067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734236, "uuid": "92153634-7bea-412e-8541-f50f5568367c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734236, "uuid": "78fef370-1789-4143-b611-6e21cc94ba48", "value": "mips.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11e720e-c32a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650734866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734866, "uuid": "524d62c8-a963-45c8-a929-7bd49bb386dc", "comment": "Malware payload (Heodo)", "value": "ff60533dda9dd9750b7f6aebe7a1b04c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734866, "uuid": "1527ce4d-fd9b-4df9-9919-972d3c279e72", "comment": "Malware payload (Heodo)", "value": "71fdeb57c5d7f25abc353ceba335eef0ea2e92c7025db869c4190b49c5b9d454", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734866, "uuid": "f04a1433-7c36-4405-92c8-dc160d29f24d", "comment": "Malware payload (Heodo)", "value": "68f7163d28d3fee4ad995089b9761aeb041a7759", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734866, "uuid": "b5ac2edf-a4c7-43a8-a47b-6650892325fd", "comment": "Malware payload (Heodo)", "value": "445ac623cd079b46c5141d73311623526ea6c22a3f035c92201e5cb39339cff0e38f0dcc1cf6fec93158ddce3e5eeb92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734866, "uuid": "b714a344-742d-45d9-bd6f-cfc4bae28cd2", "value": "T1F7A4BE11F583C133D0AE1430297DD6A60AAD7D304FB499EFA7D45A3E4D742C2AB31A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734866, "uuid": "7c4707cb-37bb-4913-9b1d-3c3dd0cb0985", "value": "c78edb9d5780b46eaa0956a2852d0a7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734866, "uuid": "e49630b1-3c7a-4642-a077-942adf63496f", "value": "12288:kCy25dXCvOvAei/n8fzoueeyju1oN4uYLtyFYeOKNx2U:keAeikfziee8ERcy6nKNx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734866, "uuid": "ea0cb6dc-6781-4e03-b30c-0840f2571e86", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734866, "uuid": "354f7446-c767-442b-a8a1-699271dcd257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734866, "uuid": "afe5f7f1-33a1-4de6-b08d-fb2bb282a9bf", "value": "Vhowlvtwzr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24544065-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650734201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734201, "uuid": "89075284-0f4d-46f0-b2e0-6aca7697f2c2", "comment": "Malware payload", "value": "17ea90c085579d086279a99f33f5aa89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734201, "uuid": "54ca4f08-2641-45f9-a8ed-5648e69d30c8", "comment": "Malware payload", "value": "71fe5756d2375f54fbf952c1f2a7a88b45ad826cf96215d55fc4827cba54dd93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734201, "uuid": "d2ecbf3d-ed7d-4b91-a1de-9fe4ae8ed025", "comment": "Malware payload", "value": "10af3d390e5fea7efa0aaf37c678526f7039a393", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734201, "uuid": "18b68985-44ab-4f2d-9be9-dc2f7cbd53c5", "comment": "Malware payload", "value": "d9a11b693026d3670af577d2f7e572b96705090e93d12306b4735764dbf1a7ca045d361f98e6d4b0d65a582a497bda4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734201, "uuid": "001deb7a-0642-414a-b1df-11b4e72f39f8", "value": "T156930941F9454727C2D327BBF78F879D3B365A9457DB33016A346EB42BC2B882E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734201, "uuid": "6ad111b2-f98a-4e6f-a13f-531449fcf14f", "value": "1536:O/n/f7+OsvbgJJPiou+TyVBpOMeu0JRX35k679l5MsrPXCtUi29maRqQ66/QfXCF:k+pbgJJPbyVCuEXXrPXCtsmaRqQ66IfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734201, "uuid": "6aa5b8a7-34bb-4976-9771-42957b921f6e", "value": 97559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734201, "uuid": "29c70555-0d84-4cdc-a1e0-e6279cf5a515", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734201, "uuid": "e54cc8b9-d091-4c1c-aaef-dbb5c5d49dff", "value": "dx.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2947f042-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650734209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734209, "uuid": "5e77e46c-89a3-4d9d-8ebe-9f192204c22d", "comment": "Malware payload (Gafgyt)", "value": "15c8ea132bfc3b660e1136041343b97b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734209, "uuid": "28c1d089-d5b4-4d5b-aa2a-d41d88f9206f", "comment": "Malware payload (Gafgyt)", "value": "71fe75c38d8d0a5ccc17fd90427beaf45e64a8f29654e1555668917c2fe801d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734209, "uuid": "62dcd4d4-a913-48d8-b289-f397288891ab", "comment": "Malware payload (Gafgyt)", "value": "21d3dd0f2a3a8c7742adbe25f08d422b05637c9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734209, "uuid": "cdf683eb-973e-4fcb-bb55-2afb0823a69a", "comment": "Malware payload (Gafgyt)", "value": "12a3c40885f3eaa072d5505455723b5f63d2a1128743ea47c6dd760796dec46692cba7863e7164fe3b8ca08032733096", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734209, "uuid": "55897728-3846-4b03-b0a9-2b7179f6e1fd", "value": "T18BC3F705F8014767C2D327B6E68E4B8D3F3557E467CB33126A385EB42BC2B992D29D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734209, "uuid": "c739626e-3e70-401a-abfd-5682186fe61f", "value": "3072:posaWhJgdWSCQ4TxFhSWT6iGToPTbTmVZqQ7Dk4EqXj5e:JJrgdWNvTxFhhT6itTmVZqQ7DXEqXj5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734209, "uuid": "2a1513eb-2982-42bb-8dc8-fcd7f0262699", "value": 118931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734209, "uuid": "067d61ba-61a9-4e79-a0c7-83811d3ed3ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734209, "uuid": "dfcfc3d9-9932-402a-a978-62cd59eb24f3", "value": "fx.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1baf9328-c35e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650756950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650756950, "uuid": "3e581bca-db0d-4127-a5e4-48085bf7f69d", "comment": "Malware payload", "value": "a7a3559eaf5ec8a2ff549575b4ccf7d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650756950, "uuid": "5b2fe390-0c57-4d53-888f-25755214fa20", "comment": "Malware payload", "value": "73b99bb8357de2e6667860d0fa9a554db1a55c169e63b689fae6a1c65faa6232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650756950, "uuid": "a44e4fd3-052e-49fb-829e-360eb28d919a", "comment": "Malware payload", "value": "689e661248c48787cb1200ff7b71a22db5cb78c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650756950, "uuid": "3f66d8b7-4633-4159-b051-ad2f331f6582", "comment": "Malware payload", "value": "53199e9f53c725ed238d68d24e48b22cd20c1a2e1aac54e2b47e65ace654f961e5d5d4e0cc3060c51c545cee5b0f7fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650756950, "uuid": "416366f7-d92f-4f32-a42f-c9c06dc40165", "value": "T158158E59F6E444E9C47FE1BACE46C22BE6F1B408537597DF02A04E661F23BD0693A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650756950, "uuid": "edfa04ee-ffb2-43c7-9d32-72d66b9f5077", "value": "58f9531839fd9806cc1341c1500fe433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650756950, "uuid": "4ea35f5b-a3e1-4f0a-a911-6d962c83b836", "value": "24576:/2DW/xbMX2YIbxQsu3/PNLoQ+Hyq74jRk:/2EgXoQsW/PNUQWj4jRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650756950, "uuid": "feee185e-aab8-4a31-b713-3377744a0fe8", "value": 888600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650756950, "uuid": "4b41855f-cef7-4787-989b-569f007a016f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650756950, "uuid": "97b7ad16-5479-4834-ad2e-2e30b88de147", "value": "is-RCJ40.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7f4914-c302-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650717518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650717518, "uuid": "a9ba451a-bccc-4575-a21c-b99f30bf6eeb", "comment": "Malware payload (Loki)", "value": "e70c6ec8f98d9cb0e47ccf463a745aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650717518, "uuid": "20a2f7b3-5bac-46d0-b8c3-7e24f07d3806", "comment": "Malware payload (Loki)", "value": "777d10cbbaef096e0fde88a2a3a201c5fa05673fa064ff328ee26b444260a5df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650717518, "uuid": "8aa6791e-32f7-4549-831f-d772ca9dff09", "comment": "Malware payload (Loki)", "value": "903ab19a850ec00ed7e854cd8403cd6e4098937b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650717518, "uuid": "209d3325-9a5c-4af6-a613-d7065f367956", "comment": "Malware payload (Loki)", "value": "9d677f0161d6f3b77c305900de7444c365983fcf80e5cdff59e0b4969e03534f5492cf2ef2b7fa4d4cb259acd2fa8518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650717518, "uuid": "11f3b8c1-aca4-45c4-997a-cae9959229b1", "value": "T19A72F80763A45732D6750B7B08A253809333EA477861DE6D788C605E3F7674283A3BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650717518, "uuid": "7a238543-307b-4417-948c-a141caca21b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650717518, "uuid": "9b145dab-3fb1-4053-ab3a-ca5ecd5317c3", "value": "384:jDjUzqlzD33GtiTYUYYH+QG4PfffffD3o13ptYcFmVc03K:jDblzDT0c+QG4D3o1ZtYcFmVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650717518, "uuid": "35f392cb-de8d-4fdd-b294-71e7c2fca243", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650717518, "uuid": "8ae7d402-14ec-4cf7-ae00-330d87e788cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650717518, "uuid": "8135dfec-03de-4356-97cf-11185ec9d67d", "value": "Vkomniv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2792ec5-c2a7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650678605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678605, "uuid": "9a5a96f3-8142-4643-854a-79d007388801", "comment": "Malware payload (Mirai)", "value": "f50986e2d45e83703ce7a1d707506f59", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678605, "uuid": "9ad088f5-541f-4d44-b905-bc6a082a9e83", "comment": "Malware payload (Mirai)", "value": "77d42885c670ca75d4110c2563c41065ec28c4fe9a8dcdc09d00ad941cb679f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678605, "uuid": "ed24f734-1263-4d53-b1e7-d38f92b9457e", "comment": "Malware payload (Mirai)", "value": "4bc3a0004938389c1245fe2d013dc3f43c72d00b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678605, "uuid": "7e6b4d9e-3877-4575-afc9-f7e6813c009d", "comment": "Malware payload (Mirai)", "value": "df17f67dffba1f2a50d5d123288f93ba796d95043bafa91c00190dcc3054d3df09b23043d197e74da31a0632a56ba3f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678605, "uuid": "f5708fc2-fb69-4820-85a1-8d274eeae9ca", "value": "T17BC2E122DBEECE4EF51FC0F6CBBC845221216891CA8957D2E9F7816CA3514742DA87D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678605, "uuid": "c58cfba4-bd56-4b98-b3a1-0724a83ddf1a", "value": "768:A+xJN5GcRCnLcQXBQUpR+PdBliCF9AEgaTqvyqu7ModU:AU/CnQNGydiCFSaOaqu7Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650678605, "uuid": "020ad013-ec1d-4463-a9f6-82569d0039ab", "value": 27756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650678605, "uuid": "4cdeea0c-8e18-46fe-980c-affa9137c71a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678605, "uuid": "d707cc5c-9a9f-47bb-9a0e-516540a56f66", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e6a228-c2b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650682751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682751, "uuid": "216a022c-4590-4a61-8627-a796d3052f65", "comment": "Malware payload (Heodo)", "value": "09c2072e381a6c252d7ace6185f1f1ac", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682751, "uuid": "05d31baa-b546-4c7a-a624-502ae8030284", "comment": "Malware payload (Heodo)", "value": "784cbe1f4c8366cb23a4bc0e9e73a39339c98590d4c4d4d3310ac5e23ca8448e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682751, "uuid": "2ecc67d7-80fb-4102-a0e9-0dd32df10bc1", "comment": "Malware payload (Heodo)", "value": "5eda1fd4b6e2f0bc9db9a16c3ad70d830437a188", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682751, "uuid": "3f3e9dfe-48a3-48f7-bbb7-91e7ee1014a2", "comment": "Malware payload (Heodo)", "value": "0fc309cf90dad4aebd0405ca6126522bc573d3df89d491b6eea1c738033348e7320681e7e80d5f7f7aba59c390e583ac", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682751, "uuid": "e3f52042-d7dd-46e7-89ed-a58653c5379b", "value": "T1A8D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682751, "uuid": "de405d94-c79e-4dfe-b017-c7e02db5263d", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682751, "uuid": "0a45fc91-3fd0-40ab-b5f6-aa43f15345e1", "value": "12288:C1FIcocJwMTHzXO7N2JBHiyzskF1CubVnmn:tco9MTHzXO7Ng/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650682751, "uuid": "0b92c3d8-2072-44a7-8bda-bc291fd16447", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650682751, "uuid": "8e1a88ee-a3cf-4788-898a-96cc0bb5dd88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682751, "uuid": "2e44f7e4-0499-4c7e-bdf6-3e6de0dc996a", "value": "09c2072e381a6c252d7ace6185f1f1ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c89bb79-c2c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1650691292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691292, "uuid": "52c606f6-b091-4b87-94ef-05dd3b625280", "comment": "Malware payload (njrat)", "value": "4c16fded1a40c9de7bf898834fec709d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691292, "uuid": "1cbcbf96-2089-4950-9054-4f8edd280b7d", "comment": "Malware payload (njrat)", "value": "7a77140d1deb8de7fd4562f8f878e67cdc751380dfa2f702bdb15ca2c597384b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691292, "uuid": "e7b3dd97-24f9-47c1-9250-9b97ce68b05d", "comment": "Malware payload (njrat)", "value": "2e675d50e01a405af6258940626629ad150ece0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691292, "uuid": "e02cd836-d94f-4331-a626-21aea8f74deb", "comment": "Malware payload (njrat)", "value": "a4f514bfbc41e20820500d2b41d09bef9b1baf12ffff359924a1fd483612818fc55eb526c24abd343a84df412bf65c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691292, "uuid": "a5b6be17-1662-4b18-8f95-cf6aae128a4b", "value": "T14BB4E1D8B900FBAFCC57C5B1D8149C509EA06D6EC3C6420BA057326D7AAF3438D9B5A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691292, "uuid": "eb47bc89-0786-4815-83b0-dabab76e182d", "value": "6144:vD3BWicNZ5LhcBk6taMeajfKVtxq6YJJUoeopfDhmUfJD25RLH/kn5hbbu4Ut2FQ:wNZ5LYsMDOVVmvf6H85VquZJYmyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650691292, "uuid": "9fe22a83-3d99-4797-b6f8-b1f1c7224306", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650691292, "uuid": "1753f62d-7168-45fe-8862-95d1ec087229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691292, "uuid": "afe205ed-2015-4c56-8a06-c2794dc2b5c9", "value": "4c16fded1a40c9de7bf898834fec709d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ac9adc-c32b-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1650735176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650735176, "uuid": "585cf471-ead2-4188-9a53-bd9c48fe4623", "comment": "Malware payload (IcedID)", "value": "b6a1a8c4b98868d0cc39e18977a85551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650735176, "uuid": "a902e752-a17f-447e-b586-29d794efbe3d", "comment": "Malware payload (IcedID)", "value": "7af03ce5ef5174cd89b3c38de891aef625fff57b7a8acb414837c641fa69d5bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650735176, "uuid": "f93d0573-97b4-4409-a4b0-5570112c755e", "comment": "Malware payload (IcedID)", "value": "0fe6890d05efcdb68c798ba6b4623480a7fed349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650735176, "uuid": "5b6c0ea3-eb4d-4295-b7ff-271c6cb5a3d9", "comment": "Malware payload (IcedID)", "value": "b2f772beada4a885fffa2488f5229b2e8dcb4e84647e76378738709548d2aef0ab7e3bbddf3f983267dc964197cd8db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650735176, "uuid": "80e45763-d5b9-45a8-afc4-47c349417195", "value": "T1C564AFBCB6046CD6E56E527BC9957CE923B337228D87D8CD8068BBC305A3771EE06845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650735176, "uuid": "e615a5a4-5b06-4bdb-b4f7-b550cbe058a4", "value": "6144:WoV967Vth96kGrMVpdoJqAIc4gJmaAqTc5YnEVwM8JBjqACgYZ5g:vj0Z48pd//emaAl5YnawhBO3ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650735176, "uuid": "8d4f7850-0593-47c6-8e9d-461fea98a00e", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650735176, "uuid": "da770b29-80fb-424e-ad55-2e04a0e05499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650735176, "uuid": "8ee4a529-f928-43f3-a33c-bafc0dcda028", "value": "oloqr4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb74ba52-c359-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650755151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755151, "uuid": "6d921ff1-fc86-4145-93ac-b8b52abc16a7", "comment": "Malware payload", "value": "c87ce6c8c437ec89df655561b5ff3d47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755151, "uuid": "884ff8be-58e3-4cc4-b889-87ce77bd01e7", "comment": "Malware payload", "value": "7d2694a0aba1b7009bab434e115f26266a45dcd457fbc17daa08d755a49a9fbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755151, "uuid": "6a0b5fc3-a6f1-46dc-a28f-b528d539407a", "comment": "Malware payload", "value": "c226366fc9b2887ace1ac4d41c51c4a4857f4c02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755151, "uuid": "12482cbe-c99c-4dd1-959d-9e593ecd58bd", "comment": "Malware payload", "value": "70767b96dd76fd0e9efe28a466b6a5ff303caf11fb1f4b778d10bffa50cedc1a43638b48ad91051d2ac013e06793dcbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755151, "uuid": "e2dc7bfc-85d4-437f-b122-d070b9a26e5f", "value": "T17DF2D036D5881A26EFAFCE67AFC0D08273400F2D72E0EF5617851B0155A6D76B2396CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755151, "uuid": "88d84579-6a8c-414e-bc70-5ce49fe8fd29", "value": "768:fBRxR7jjpk2p38qTY6dUJmqxOusTL4uVcqgw09YJiRFP:pRxNDU6deZOusTL4u+qgw09YJ8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650755151, "uuid": "025aefc4-9bd9-40d8-87a3-f6b9c7afa25b", "value": 35292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650755151, "uuid": "0c04781f-bc94-4193-bdb8-6f927c23d32d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755151, "uuid": "f55f5007-2fa1-43e9-958c-7b68e5494c76", "value": "c87ce6c8c437ec89df655561b5ff3d47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c883bfa6-c2d1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650696680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696680, "uuid": "bb038f90-63ff-4f1e-815a-58c0b3b8e3d8", "comment": "Malware payload", "value": "fb9da4775539a0df96be320911f60634", "object_relation": "md5", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696680, "uuid": "c000b6dd-3500-4bcf-85e5-89f9c8c8e351", "comment": "Malware payload", "value": "7d36dfbec1358c0c1ef56845dd774cea326d77a50bfe2873d3e6321dd6434352", "object_relation": "sha256", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696680, "uuid": "54930015-3678-4b73-b23e-761cac9311f8", "comment": "Malware payload", "value": "e97a8fdde3d17a652285f344cd3ec130e6587aee", "object_relation": "sha1", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696680, "uuid": "2ec4423b-9b70-4aa1-b792-6501645293ba", "comment": "Malware payload", "value": "bbadfd2f519c50c63366b7dd71d280318d8caafcb8871705e92552566b470a993c0fe606d34f792d1012edfe81aa2091", "object_relation": "sha3-384", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696680, "uuid": "3e125872-3993-43bb-9e8e-89b2e1e2675e", "value": "T15EA02407FC04DC53011040530D30DC0FCDC444707005C4747F41CCD510057400D41401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696680, "uuid": "b81eb2a0-fe67-4bc5-b780-9a95783b0ec1", "value": "3:FER/1GXfeFHHFZ3BsO+HHHHJvXpv:FERtbFHTB3+nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650696680, "uuid": "58ee21f0-1e73-43c3-b8c7-5067a017d303", "value": 80, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650696680, "uuid": "03196d5e-348a-4940-abf5-a57191c7e53e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696680, "uuid": "51ca0596-66f8-4baf-beb7-e91873cea769", "value": "hidden.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb73df8c-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672204, "uuid": "f843f158-42fb-4a7f-b6b6-022f500c68af", "comment": "Malware payload (Heodo)", "value": "278d1b7326cae91ae400a5441c80e23b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672204, "uuid": "80a58b5e-bb74-4f61-bcdc-740917fcba32", "comment": "Malware payload (Heodo)", "value": "7e7d191cd84c8290c2608ac6020dd0ad65b7edaf56f06d0b82f26097494ce377", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672204, "uuid": "2fb5069e-ad29-4ebb-91c6-2b5dc876cf41", "comment": "Malware payload (Heodo)", "value": "aa96726f4f91dae374320bfacb5724cbc92e1c4c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672204, "uuid": "0c3f7ab6-7100-430e-91f7-944b5ff39eca", "comment": "Malware payload (Heodo)", "value": "f614bbdd6cfec0113b5256309a649fd9e4c5b8e0bce6b797730eb0ee50a2569228f6d56e1963fd6f5260c17ed74280ba", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672204, "uuid": "4a8d69f7-a8e3-4ee7-bcdc-98df5e3caddd", "value": "T198D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672204, "uuid": "d62cb8fb-2ced-40cd-883f-741cae1c64a0", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672204, "uuid": "ed1f16eb-7ae0-4647-b38f-bbec9b77c3a1", "value": "12288:C1FIcocJwMTHzXO7N2TBHiyzskF1CubVnmn:tco9MTHzXO7Nq/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672204, "uuid": "f62bb676-9be7-4d10-a32f-d2698c203e6b", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672204, "uuid": "98809b9d-ccc4-4ce8-8c1a-ba994474581b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672204, "uuid": "fd59827d-5250-4189-9520-da87dc8065b0", "value": "278d1b7326cae91ae400a5441c80e23b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2040da18-c35e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650756957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650756957, "uuid": "1c02e26b-77d7-4cec-948e-d3ba5622ac5d", "comment": "Malware payload", "value": "cc0ac6da39057ef0aa6ca5eba5537eae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650756957, "uuid": "39c6831a-349c-4a5f-b251-1d486a0efb72", "comment": "Malware payload", "value": "80938376d38b3d5b815d1c412348b9dd6851fafe2c372ba970c767676bec5eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650756957, "uuid": "13662bf1-3f63-4a5e-b27c-6587bef09c06", "comment": "Malware payload", "value": "56861f7eac2f747d0812a8b36ac2a7ecfb14081d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650756957, "uuid": "287844f5-b281-4bc7-bba7-748e5d4d72bf", "comment": "Malware payload", "value": "e56b0a613ad30c96649a90f7389364cb44d3fa0c6a908debffb7f1d6ad46b4735058dbd50cb978a701ea777064939ca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650756957, "uuid": "87bdab2c-e96c-41af-b3d3-6d723206237d", "value": "T1BCE52957F288623EC06F5A31473386EC9837B6656A538C1797F93C0C8F355882A3E676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650756957, "uuid": "6ddc2be2-cb44-46d3-b800-cfb2582669a6", "value": "9825b4c9a35eb9a5c5e347cb9ca988ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650756957, "uuid": "61d185b6-22e4-455e-9847-304b0db3a2fd", "value": "49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVx33387:d92bz2Eb6pd7B6bAGx7T333w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650756957, "uuid": "5f3c3bec-ea8c-4dd7-ace8-ceb5a3897cf4", "value": 3151872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650756957, "uuid": "3b0b1fed-ce5e-43ae-a332-37b18762aceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650756957, "uuid": "922779f7-6b07-41b1-804b-8cac16fe3f81", "value": "windows11-setup_11_56404.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60045c1e-c2d0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650696076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696076, "uuid": "37d73a45-baef-4190-b814-8ef3ade302fd", "comment": "Malware payload", "value": "6b2d8b82efb9990b4d5e2687e4cad11d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696076, "uuid": "6ba74904-abd6-4eff-aacc-b12f58c94d20", "comment": "Malware payload", "value": "825bcade5a6323c5d81b11a572e51232a0ddb205107c2edeb5d42bf94f231f49", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696076, "uuid": "9731e36a-697b-4826-b9e2-a0b28d2f3cc5", "comment": "Malware payload", "value": "dab7a69bcbfcf5b92d7ab700eaa7abe7df84c32c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696076, "uuid": "8197b4ec-ffad-4ebb-b708-d6fe0ffd60e1", "comment": "Malware payload", "value": "c173bfa89f973b28653bb653d15a5feca9941774d62c73ef5777eb6c8eb77573c191d37e89616bd89509a20d922cc897", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696076, "uuid": "c6f53a8e-78a4-47f4-9a6f-4a7e00ddab3e", "value": "T17577CF05F514113CC879F8B8CA4EE072D9293C4A9223855B2FAA7A14BB776E0DF1D7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696076, "uuid": "d1070799-9325-49f4-b2ae-1da98500e74d", "value": "393216:rIqCN0Teu1aj+s3FNgIuM9zhLfHIF1dXpYxYt:MqCyTV1TsFitMhZoXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650696076, "uuid": "80c7b081-56ec-4784-bd7a-51b7a8219c8f", "value": 32978891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650696076, "uuid": "19f0d2ee-c64d-4026-bdd8-03f52debfdaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696076, "uuid": "234330e1-a5a6-42f9-ac8f-34a73958d01d", "value": "Protezione-Cliente.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310021ca-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650693420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693420, "uuid": "48f760e5-cb89-449e-bc88-2210059a313b", "comment": "Malware payload", "value": "719f585d34ea9e549872217df69866ff", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693420, "uuid": "e059d813-b410-410f-94ff-f57c83c921c5", "comment": "Malware payload", "value": "86e6cc3411eba52cc8dd45692ef087e5b23643a138f80d50fea78f368f3d189d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693420, "uuid": "72df7c6e-4237-4d3c-bffb-7d583ce04802", "comment": "Malware payload", "value": "954677bf0099ec60a14ea8989b0e6cb8b38fc9d1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693420, "uuid": "a1586b6b-c970-4e7e-859f-f330aec65a2d", "comment": "Malware payload", "value": "9f1d94a6eb650f92a33947456f4cd76ceeab631dd3d5bb4489091af270208675c5a2947af5e686472551dec3c4191179", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693420, "uuid": "8506c59c-8745-4cd2-99c9-0637347a798d", "value": "T1FF165BB7B2C9693EC0AB16369537A758893FB76166068C1707F40D4CCF36481363AE6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693420, "uuid": "4225f798-0945-479c-8c4a-fee784be9a01", "value": "49152:lYM82wJBi7Ln3o0hwSX1RoUVyvSYJkKZ+CYrVTZlyfmUecgfOYL3A:TwfkCSY316fOYLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693420, "uuid": "c6a68e52-14ea-4100-9fa5-3b96f9780372", "value": 4130304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693420, "uuid": "4b4fb222-d677-4b90-84f2-57b84e422b39", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693420, "uuid": "80d81fb8-2d7a-4764-851d-3f87296c21f5", "value": "FactCarrefour.ArchivoNOW.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dac67fa-c2f7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650712715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650712715, "uuid": "758cbde9-9ff1-4a46-ba09-c3e4e7e6722c", "comment": "Malware payload (Heodo)", "value": "e9cf301a780f3a1b5895f5b96650e06c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650712715, "uuid": "83b81066-1ca1-467c-8a5d-db5f37f93b4d", "comment": "Malware payload (Heodo)", "value": "893506a6f85b810cd9421708ca715903ec2c58cab4539e8ef64f1dd129ee20f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650712715, "uuid": "e56c2cc9-2361-4c63-acce-bf22f7a6d9c0", "comment": "Malware payload (Heodo)", "value": "c0ac7163f33f10a2b8c7bf722bd59838574e5bca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650712715, "uuid": "5f06d53d-ce42-4756-906a-eb73d74e748d", "comment": "Malware payload (Heodo)", "value": "707380d46bb4ce3bf460404572b10da2fbf8d97cbe65e40b8f129ca2b501ec9640e1bbe7e3cc7efbe060bab9635ae566", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650712715, "uuid": "559b40c4-00a2-485b-b300-d807b93f3650", "value": "T1A1F44B62B3716C65C3D3967ACFDF45C59AF2AC41472282BB2139F6394E336921F36218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650712715, "uuid": "6f493ddf-9d32-431b-a01c-a1a99397bcc2", "value": "12288:J1U8sNIBLKhKmCKzTrjEi0I8PxiGhWzx+o8/NQfN7IT5p:oRAZKzvj5T0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650712715, "uuid": "9bcf2a6e-a569-4ecf-90c8-7ac086d08e10", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650712715, "uuid": "d7c7d8a6-e770-45e1-be02-575bda8457e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650712715, "uuid": "87ec955c-97b5-48de-a006-7d2e5b8864fb", "value": "emotet_exe_e5_e7e7986722f3382dc45999095ed34b46e83f103467e0494bbea588e6fb1185b0_2022-04-23__111828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2b1d7f-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650674539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674539, "uuid": "03258b75-48bc-45c1-a16c-5678198564f0", "comment": "Malware payload (Mirai)", "value": "a81ef57772651ce1a4055aca0ac7a5d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674539, "uuid": "de891308-0230-476f-a22e-a5a7e383bb00", "comment": "Malware payload (Mirai)", "value": "8aaa39047b94ba68e1202eb38296bde48527887bba0795b2243c601184f1e6c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674539, "uuid": "41029316-f388-4070-9138-9726aaa913e1", "comment": "Malware payload (Mirai)", "value": "cf6bd61a054e5196bc5bdf17216781bf1e0cd516", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674539, "uuid": "e3ebbe84-412e-4a7e-a144-0c7cb25d318f", "comment": "Malware payload (Mirai)", "value": "6e4442df96152fbf1c94778cb18914dd1b08e71e4f6b529afba29a12d6a1a05cc5ad9750e41b8f1629bd1cbcab038b29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674539, "uuid": "7c5a88a6-88bc-45f1-aa92-b8f913f2d336", "value": "T150E36D46FA418B13C4D5277AB69F42493332A794D3DB730799285FB43F86AAF0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674539, "uuid": "3646b215-7d74-472f-942a-b2689ed1607e", "value": "3072:wz0gOYHn1BRE+hjQRtpMMlk6Kbq3kTUx8pnfwhM/9uHAjzmTwDOQ+J:A0gOYH1xqRXMMlk6KAkcinf6M/9uHImf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674539, "uuid": "2290fd4d-cdd0-420b-9c55-5b7d0a71fce1", "value": 155380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674539, "uuid": "3e82bf33-1d82-4231-b77e-9bd837b8c09c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674539, "uuid": "0b243698-968c-4632-980e-d8539fb5fe02", "value": "a81ef57772651ce1a4055aca0ac7a5d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc528b1-c2cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650694223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694223, "uuid": "9160ceaf-c4c9-4f3c-bf17-22d6f4a115d7", "comment": "Malware payload (Heodo)", "value": "7a716abfefb3176ba649c9e1b5e1507d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694223, "uuid": "2aae84d7-bf16-46d7-9713-dc9d57530f0b", "comment": "Malware payload (Heodo)", "value": "8c1740a2cf3e7265e5f0b4b690be7113ed6c45a0ed5bf0064235f5b6477e3646", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694223, "uuid": "119eebbf-aaf6-4beb-9afc-7c500f88ffd8", "comment": "Malware payload (Heodo)", "value": "d3dd6137f9b77bd03592c8be1a1415261815e00c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694223, "uuid": "dce5a191-d1f0-4305-8fd2-aa5aea3a3d3d", "comment": "Malware payload (Heodo)", "value": "e0b0cd9fed34f3b230d8df6a1711f6c2d2b11d38befe4f143f3cac33849c5c27217376b7baef00dec2c08c6728ef4664", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694223, "uuid": "0b3f1028-9088-4e20-a8ac-905dc61f1450", "value": "T125D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694223, "uuid": "376ec5cf-64be-4d7a-82ee-8a4a72325d1b", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694223, "uuid": "84d8797c-1327-442b-b6e7-4d27dc1fbcca", "value": "12288:C1FIcocJwMTHzXO7N2YBHiyzskF1CubVnmn:tco9MTHzXO7Nx/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694223, "uuid": "cd7634ff-32b6-41eb-9284-41345478f106", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694223, "uuid": "ac6ff5db-1b19-4fee-a123-34f5c86a291a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694223, "uuid": "4c6fed49-e5d6-4f8f-a3f8-cf8db96df213", "value": "7a716abfefb3176ba649c9e1b5e1507d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43547cd2-c2c6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650691733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691733, "uuid": "36e82871-7a80-4cf0-94b1-42c3d76e9bcd", "comment": "Malware payload", "value": "f948885448d59f725be8b995b63aace7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691733, "uuid": "e89f67e7-5875-4539-893e-066b09e39f42", "comment": "Malware payload", "value": "8ccd2737842b65b2f0fd5418bbb2e17803cb1866860d679d6ef3b2b8acfc8b44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691733, "uuid": "409fcfef-630e-4be8-9c02-8804d8beeb59", "comment": "Malware payload", "value": "153f0c96315d126fa057fd0754e601b7c54017a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691733, "uuid": "ae95a86e-85d2-46e3-aa6e-18bf45723dd8", "comment": "Malware payload", "value": "e9190b866438686da4102e7b35c7ccf583e562e72bc4327ba514ed6e4c8f2a29d1dcffc7756c3106b94e4b533ddb5178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691733, "uuid": "960dfbc6-371d-47c6-8f73-64a2afbb526a", "value": "T1CE75E01B73024516E914DBB8DA777F120694EDBA59A4A313F3D83629E43F6FA1B80703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691733, "uuid": "41181571-b8f9-4821-a16f-c223255e2545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691733, "uuid": "fe83ee77-c922-43f0-8812-e44f6f9aaeb7", "value": "24576:P5OYIFAIu83P3+qKrambYr46WxQhP/NtS8qjI9v1rJsKUP:hO97ROqK/m4t4P/N99vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650691733, "uuid": "dfd6e529-7584-4fa4-98c6-0ce292230a64", "value": 1593856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650691733, "uuid": "ae388eed-fdb5-4326-8e8e-6282d0b9353a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691733, "uuid": "9c5142dd-2182-496a-bda5-901359382c85", "value": "Item LINEA FY3050 Additional Order ALPHABET New Order- March 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb1c31a-c2e0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650702813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650702813, "uuid": "a86f86bb-d150-4dc7-917d-92fd2728a775", "comment": "Malware payload", "value": "c9cfc8e97b19b51d45d7c910dbe0868c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650702813, "uuid": "1688f763-388f-4764-b603-c2fc6655589d", "comment": "Malware payload", "value": "8d8b94e9c2c4769534654bd2d1485248aa0de0af2088d5a88aae96daa7af8f1e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650702813, "uuid": "7aef75d3-f464-4f36-9829-5e9af4ea7c62", "comment": "Malware payload", "value": "5e69dc7461f51ba0c49690a725fe50ec30e519ad", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650702813, "uuid": "af5f6617-03b5-4f2e-afc1-76106b1f29ac", "comment": "Malware payload", "value": "6b3404b6b839125d3e0c90eb36adc83cae7b6e47b40cc555e8d910f9ebfd5b1fd01039380f92ca544314b29585e8ccba", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650702813, "uuid": "c6fc7b8e-ad65-4703-8009-4803dea0e906", "value": "T12B44E06A3F94947EDE1BC53A49308873E27D01DA8707590E67F4D106A1B2EA50F07BEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650702813, "uuid": "32d61f10-ba9f-4827-a538-bff86966380a", "value": "6144:pREhfgRe8dILkIvCoFuck81iF0LfIE5fBand3c/RTLBXc6IB/cmIxTIki:jgrqkkI6oF71ikw2poM/BIBEpxri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650702813, "uuid": "404316af-ff38-4cfd-9511-3fe1774d874d", "value": 268763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650702813, "uuid": "698084b2-350c-4f05-b78e-aff54c8eb1a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650702813, "uuid": "5ef48a44-965e-44ae-a63f-417c729a5469", "value": "burploader.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6e55f6-c2d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650697145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697145, "uuid": "1413df19-2aad-410e-9939-5792921279b9", "comment": "Malware payload (Heodo)", "value": "6e2d86a4d282708f51bc717b954ada59", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697145, "uuid": "497c6538-5f62-4e34-8f0c-c080dbd881c1", "comment": "Malware payload (Heodo)", "value": "8de285c067d7d5829761881f207461784768aca9bfde8d5050690f14ff84803e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697145, "uuid": "8f6d69fd-bdb1-4cd3-95fc-32742faec2ee", "comment": "Malware payload (Heodo)", "value": "67acc3eed7f97fb32e5cb53d539db3d6767f5771", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697145, "uuid": "ab076576-05be-4891-a865-d11209a6019d", "comment": "Malware payload (Heodo)", "value": "a6f1b151dd87c1289ccef2cd0a3f7feaab792cda9855cc4f49477826612dbb4e61257ac1a8e57eb21135fa3e2d789689", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697145, "uuid": "80e01ff1-4033-4498-bbd1-beea5353f934", "value": "T1CFD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697145, "uuid": "44e69779-aa53-4360-8dce-447da9959b37", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697145, "uuid": "422decab-13f2-4911-a8da-748d79b21797", "value": "12288:C1FIcocJwMTHzXO7N26BHiyzskF1CubVnmn:tco9MTHzXO7N7/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650697145, "uuid": "3dd3f95c-b839-4f96-9a9b-c5d905e5445b", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650697145, "uuid": "2d7c6c66-9730-47e1-9f5c-f651db78480b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697145, "uuid": "e3f416f9-eb4e-481b-a881-352a39952dfe", "value": "6e2d86a4d282708f51bc717b954ada59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd06bbc9-c2cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1650695802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695802, "uuid": "f503f080-8a9a-4756-81e1-2bf13145562f", "comment": "Malware payload (Gh0stRAT)", "value": "9b3e86fa835cd63b5887f4c51b786493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695802, "uuid": "a1dbf577-d8d0-4d0c-9b12-f0cf88ab091c", "comment": "Malware payload (Gh0stRAT)", "value": "8e6ab3fa1fd0a8bcef6b042cd9f0120847180ec1e57b10c28336ace670470e22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695802, "uuid": "c73310f7-2ab3-4870-b831-af3dafb92aca", "comment": "Malware payload (Gh0stRAT)", "value": "d4d148b65a1fe525527772f2f51b41e43281fe40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695802, "uuid": "280039b5-25b8-4f69-b995-d53ec8ab7740", "comment": "Malware payload (Gh0stRAT)", "value": "6b4c22989e25ee5e79b4d031c5b669a75f5822ba5695744f4e32e44c51094fd9569beb2fbb21e580b8e51f84928d3d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695802, "uuid": "e9f27862-9d8f-4619-b1b2-ce06149c006b", "value": "T16D45CF51B5C380F6EA65213005AA2B3AEA38EF470F15AFC79374EE7C1D361E0A53715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695802, "uuid": "00b6576b-274c-4e01-9aa3-d6377f168434", "value": "d85c474c7dbd53f4ca1576d267d64927", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695802, "uuid": "b2b5f21f-d599-4149-9812-da8abab3beb4", "value": "24576:sKwHE0vnaU7jOA712v8Pb4k6Mfc7wHBMbyjxUU02cA:mk0Pa4bYvrkzfMGO+82cA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650695802, "uuid": "2ee95eac-158f-4f56-a1eb-07e712294426", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650695802, "uuid": "3c996930-4c61-481c-855e-a13157fc1a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695802, "uuid": "d967cb35-96fd-45da-87e9-39f5075e7815", "value": "8E6AB3FA1FD0A8BCEF6B042CD9F0120847180EC1E57B1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b401b5d9-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650680755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680755, "uuid": "d882d8ea-36a4-4bb9-b1f8-b6368987e408", "comment": "Malware payload (Mirai)", "value": "59af4219971f475867a56aab735ddf83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680755, "uuid": "046b50f0-6b2c-465a-ae34-1ece2f39a8a8", "comment": "Malware payload (Mirai)", "value": "8ed43ae76c862b4ffba5e8834e9e201326a39c1c75fd02cddcfe198895d6d309", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680755, "uuid": "55c09cc3-62b2-476f-8183-8970b401d7a0", "comment": "Malware payload (Mirai)", "value": "5fe5e73fc47c4711a7d08acb83d82d6f8eb3d47a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680755, "uuid": "5131d833-b33e-4dbf-80a1-fd753d5f6fc9", "comment": "Malware payload (Mirai)", "value": "a1194b634fc0fc98f45071e1ea8e8b07593ea1078a22837900f10d4990403f5c4a939bdb6ca34a05f4305449eea123bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680755, "uuid": "6f2b0ff2-1fcb-42ea-835c-50dc80b94682", "value": "T1AA533A99B4038E3CF98BE5BD84150E09B92123D951931F2766EEFC937D331A49E12F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680755, "uuid": "152136db-5387-427e-a2b6-c8c8f00ef7f2", "value": "768:Qea3/DEigvY/szyeCl7uV0IlQQF3CpgFHHrP0ouz8/8vahP7whgfXa/PQoV+NL:QrSg/szyeC8FlVFLP0hz8/2Uwhgfq/Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680755, "uuid": "1ca9aadb-9d9b-499e-90f0-d2a8561827d9", "value": 66564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680755, "uuid": "4d22c29f-3dab-494c-9874-70fb20795dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680755, "uuid": "ac537567-2c73-4e01-b7fd-5f52535ba9d9", "value": "59af4219971f475867a56aab735ddf83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79ebe97-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650680734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680734, "uuid": "dbe83181-2d0d-4cbf-b076-f48e85157447", "comment": "Malware payload (Heodo)", "value": "8d077d8ae7e3a9a6e3b546fc8110e20d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680734, "uuid": "c2eebf04-a7ef-4187-825a-d52428f1a433", "comment": "Malware payload (Heodo)", "value": "8f3c1c79f64b5028d1166682a3e7673643940dc02c82a42d00c21db4e8bda2d2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680734, "uuid": "80a7a309-e93c-41ac-b278-ff7bb42f5eda", "comment": "Malware payload (Heodo)", "value": "801aeef865657eb237200204d1d2dbdfbaa65c23", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680734, "uuid": "e3721e04-d5ef-4839-8725-53c90e6c9a63", "comment": "Malware payload (Heodo)", "value": "51f963a50d875fe410d8ebb2bfbffc1f53dae05a46d2bad5bcef31ad1a0a0a2ce39f06a5dfe2ee8f32ea1ae98496909e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680734, "uuid": "146e3cc8-496a-4eff-9d3e-59f28c09a380", "value": "T12DD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680734, "uuid": "f2be8ee6-01fb-41c8-925b-b7cd6ef4043e", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680734, "uuid": "03fe3fe4-67e6-41a5-9e2a-1ee0ed458dba", "value": "12288:C1FIcocJwMTHzXO7N2RBHiyzskF1CubVnmn:tco9MTHzXO7NI/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680734, "uuid": "907733ad-8c05-4885-aed1-e9578eab302e", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680734, "uuid": "4899900a-e0b7-441f-be02-3f227c953689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680734, "uuid": "7cefa52a-8a6b-45c3-89ed-3ba693f0d8d4", "value": "8d077d8ae7e3a9a6e3b546fc8110e20d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a402a501-c327-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650733556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650733556, "uuid": "84460ea6-95bf-4c29-857f-9a353511f529", "comment": "Malware payload", "value": "42a386d375021fa94205743e8664e2d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650733556, "uuid": "2fb57c13-e71f-4056-b8f2-02c10b93522c", "comment": "Malware payload", "value": "8fd3c540fb8b916c7f8b68710099872156c4958c24db929df2663c56d7a9af17", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650733556, "uuid": "fc1a1f30-3adf-44d2-9266-9e399409c759", "comment": "Malware payload", "value": "3879f450e3f0271fbaff315f5b5fd404be5a3ace", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650733556, "uuid": "860e1c79-16d5-4b36-8be0-aba1ac17b5c3", "comment": "Malware payload", "value": "e32fead3cd9e915114df963c7d19b10a9e69723fbb5fa052026f3b61988e19edc3070d7ae30dbf1db8855e80829fd6f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650733556, "uuid": "1d7e5cc8-25b1-4303-b24b-ba1435e5e30d", "value": "T18BF0D47F9201277EB3D28674D1062994333201CDE46384165A435488EB3872EE4484DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650733556, "uuid": "d1742eca-d3fc-4805-b0ba-618bc9755ba6", "value": "12:HOADm2PwRUC1MUnKebbJW2u8rfKxcBEF3n8t44Bd0MRY:duy2n9J1zfKVJQ4ad2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650733556, "uuid": "b06e9028-2ff3-47a7-8526-298d7e87646c", "value": 456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650733556, "uuid": "087450bb-8011-476f-81a6-a39b3ca73661", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650733556, "uuid": "1066672c-0261-4bd3-817c-746b1cd55861", "value": "script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d9202b-c299-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672321, "uuid": "2205fbf3-dab2-4e48-8363-1d56ea69c7e0", "comment": "Malware payload (Heodo)", "value": "25672df23aec2b75b8b9e72ca8dce7e0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672321, "uuid": "6f879a31-2961-4b52-95f6-b6fe7e6e6e4d", "comment": "Malware payload (Heodo)", "value": "92e60b6070886db1b2ddbe554a007a35e8f04bd201f6605f467da51995a77fd3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672321, "uuid": "627bf5fb-4113-4fb5-9acc-e7060ebd88ab", "comment": "Malware payload (Heodo)", "value": "5204d5211ce82686f8c2322b762f22c1ef26db16", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672321, "uuid": "80fe2ce0-3afd-4e61-b761-0eee23aee242", "comment": "Malware payload (Heodo)", "value": "1b927dcf89ac92b51e04812020e78463f37ec8c976269bfde5e3261100883bdc8bf197c76d6a1ac7fc02a44363a6d998", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672321, "uuid": "6a15f7ca-0069-46f2-ab5d-07645c2b1b4c", "value": "T1B1F48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672321, "uuid": "12fe9d42-d354-4f85-be9e-30e242a08164", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672321, "uuid": "eff24f4d-bf67-4487-864c-d6c5d9d025c3", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjui0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvj7T0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672321, "uuid": "90c207f9-0e5e-4337-9ede-511d74c984cb", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672321, "uuid": "128530bd-bb31-4c5a-8c90-f540beb61505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672321, "uuid": "444dd4b4-0fe7-455e-a968-2b70adca4e42", "value": "emotet_exe_e5_92e60b6070886db1b2ddbe554a007a35e8f04bd201f6605f467da51995a77fd3_2022-04-23__000514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73efcd3e-c33b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650742065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742065, "uuid": "2d3cd88d-b6fe-4ac9-9a1f-c76e689a8635", "comment": "Malware payload", "value": "a86fa78d81cd31b7b61740a1225f2859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742065, "uuid": "39044853-051d-4cd9-bd23-01ea2123481c", "comment": "Malware payload", "value": "94237bb090cfb3ce9fc7ebe945f2da596cf0dc633c2b747cf7101d15116a1abb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742065, "uuid": "b000b905-10fe-457e-a7cd-59ed0085ca31", "comment": "Malware payload", "value": "b490acc765d79a7b2727ac9ba1e60cae0fafe120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742065, "uuid": "ce8ab785-d8df-425b-ace5-57ecc1ab12e7", "comment": "Malware payload", "value": "15deea54cb5d07f13ba26bd22fff2082c4ae0c17134250e4488daef54bd0ffb7d18bdddc2b5c865ce36960c71ea92393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742065, "uuid": "dabd2103-6480-48f0-b5c8-7c79887ab301", "value": "T1B6D4E010B2E4C433D09229B94455C7B95ABB38366A17999B7BD40FBA5F207E1E73330E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742065, "uuid": "71cacf2a-86c9-4561-9e19-7a8a06173729", "value": "8f81059dd82062ce0b0c08bb77c6fa1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742065, "uuid": "a08947cd-5c4e-43b4-9c8d-69c07b71a3e9", "value": "12288:WDI7to0la0TmnY/ckhTxu7uwKaV/5+ZiQCLYdyvs:b7u0I0TmnY/cuTxu7O+/5+Zi7LYgvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650742065, "uuid": "94c28811-3528-4820-897e-6c9a31d39a0e", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650742065, "uuid": "cf3408ec-01f2-4509-aff8-86a07fb0991a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742065, "uuid": "5bd6589c-b827-46f0-82e1-cb7a09800ccb", "value": "94237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04ad4d3-c328-11ec-8e58-42010a9c0032", "comment": "Malware payload (HawkEye)", "timestamp": 1650734033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734033, "uuid": "bf1d9264-ae7e-4fd2-8d99-b3a360fe5ddc", "comment": "Malware payload (HawkEye)", "value": "a172f4b0fa1a44cb60901944cff7f8ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734033, "uuid": "b2933a7b-78e1-4545-92f1-24c472a36475", "comment": "Malware payload (HawkEye)", "value": "94243b53eceb2662ae632d9c3e02b5b947ea56ac4ac1db3a69fc0ca3e5100816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734033, "uuid": "2bd9d09d-c53b-4ebf-bd4d-8d230e2334f5", "comment": "Malware payload (HawkEye)", "value": "c4aa87ba839c2da6ed852ba0e936ac80d47ec5b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734033, "uuid": "0dfb030e-6b21-4e63-9a8a-76fc35f016b3", "comment": "Malware payload (HawkEye)", "value": "7b873958a3af2045d31ec578e902b669c2b3d20580b64ae3dba35bf26dab09639d591d0c31d898bf12a0baaf2c202fbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734033, "uuid": "653ee9a3-57a1-4a58-84c7-196882bb1f23", "value": "T1A595C0D6A39D81E1CD1636F2BD2827835F7A59324A3470193F9A2D5C9E630B2412DFB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734033, "uuid": "c9e2ff46-43be-490c-a72d-2da971a86832", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734033, "uuid": "fc54cce9-847b-45d2-82eb-6d91558956fe", "value": "24576:FCdxte/80jYLT3U1jfsWa5+hSDZsQ/6XQyS91TzPp5AffmQ:Mw80cTsjkWa5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734033, "uuid": "a5579716-bce4-4c75-ae69-8ea45e5aa12d", "value": 2010624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734033, "uuid": "27fb76e3-98e0-41c3-88f7-f939c643b5a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734033, "uuid": "3129c408-b4cc-4181-9a1b-16824e695041", "value": "slowday.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8fccf4-c32a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650734642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734642, "uuid": "6197021c-123b-490f-85f2-c3fadc941b5a", "comment": "Malware payload", "value": "33c2bea2a82195776196eafe96a789d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734642, "uuid": "4b40af8a-b613-4259-802e-4d0d5243e02d", "comment": "Malware payload", "value": "942759ed9618b5dfa83a39101acda6b9e4cd62675fb6f575ce7184ec0c157d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734642, "uuid": "a6decc07-e38e-4997-b545-73a289573aa0", "comment": "Malware payload", "value": "8758377103f3afb1dca465161c6b2257f9db103b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734642, "uuid": "eb4b22a6-ba7e-4ed8-8670-1bce3b39acfd", "comment": "Malware payload", "value": "fc53d6389a45a856f8259f8f2b1ec6a6bedeab467af7f28685e1d17db93732a70ab50f3427ec296a06fee96ac63a16a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734642, "uuid": "6387e4af-f0b9-41b1-b6ba-5543d7581517", "value": "T13C551213F7C30471F839463DD856C548AD2779786DE284AA6DFCE74E0EB82C28837A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734642, "uuid": "86f7cf99-9fc3-454e-b63b-a995c003b2af", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734642, "uuid": "a0dd4d48-16bf-40a7-ba90-371ea1f7344d", "value": "24576:GMjhl2EopKY5/8NdPFHJv3OVFqMHQhfAnnCgba9IT+zQDTZ6JPXDPZ/ed:FfoAY98HPneFMAnCgRT9N6Vt2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734642, "uuid": "4d7d3a86-2baa-4586-a102-b86ad4de5279", "value": 1351891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734642, "uuid": "bae72eab-5b27-4c63-a25a-e34f5a033880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734642, "uuid": "6e59f111-1571-4914-ae5b-c99a6fc0dfab", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5031595-c33b-11ec-8e58-42010a9c0032", "comment": "Malware payload (PredatorStealer)", "timestamp": 1650742174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742174, "uuid": "c60f3368-31f8-4a85-8baf-dcfb2c3a7175", "comment": "Malware payload (PredatorStealer)", "value": "0c6c8ef52aa499e92c74558acb1df782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Predator", "colour": "#00BA08", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742174, "uuid": "5afff65e-62c8-410b-b63e-c5e5e21ace59", "comment": "Malware payload (PredatorStealer)", "value": "94283fb3f4ea80fcdf3f8460564cfd4ba2c0783947c41c6216361f51b709a6d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Predator", "colour": "#00BA08", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742174, "uuid": "fe4d7dd8-d401-4110-887f-2aa6d3363269", "comment": "Malware payload (PredatorStealer)", "value": "f47eb12ccffb72ef56b8151e412c11674f1d29cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Predator", "colour": "#00BA08", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742174, "uuid": "8ca3852c-7017-4d30-9f8d-af071c014f04", "comment": "Malware payload (PredatorStealer)", "value": "6044bee41dc304c7e57bf4a50861f83cb4379caf5f319acbf2dfa40b17d04b8de7c009b44440d3df74042e9ea193fb62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Predator", "colour": "#00BA08", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742174, "uuid": "7b97532b-2afe-45a7-927b-1132fd83e032", "value": "T1F4C533F7C1119D10F39A78BD7451BEA5D38DB86890F8A0A33BBEC2B56921F341662371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742174, "uuid": "628d8b72-2c9b-497b-9e94-b165eb8b54f3", "value": "d89f3dcdac0c8dba11dc1162435bedbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742174, "uuid": "68735c15-ab88-4d83-9144-6aa0ce143e47", "value": "49152:H4SAAT7qtv9rB2fkrmLJOqwN4+ALAy4geAl:YSfYv9rBTmtOBrA92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650742174, "uuid": "648bc39d-5b6d-4de7-acc4-a7d34dd3c1be", "value": 2502144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650742174, "uuid": "1ec702a9-2142-403b-bb05-0610730c5e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742174, "uuid": "5c82d890-2366-4f1c-a6eb-29c5a1a522e8", "value": "graph.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd75e4e-c33b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650742270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742270, "uuid": "a3da3ad3-523c-47a0-be78-72abf3be4d96", "comment": "Malware payload", "value": "d4d4a40d88061185f3f89414f7b2fd9a", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "DarkKomet", "colour": "#A9FEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742270, "uuid": "ebcb475b-a238-458b-b8b1-39f9b2a20fbd", "comment": "Malware payload", "value": "9429ef640e67c9106bf05567d9a68b9600d2a78db68d95c86e38935639d70f4a", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "DarkKomet", "colour": "#A9FEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742270, "uuid": "9dfbc9ea-28c0-4e51-b99d-a5779ff2315c", "comment": "Malware payload", "value": "513f0873487f9d6cd99b90c5371f0c022d31f40d", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "DarkKomet", "colour": "#A9FEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742270, "uuid": "3f0de4ae-0dd1-4249-951b-c2b51baa477b", "comment": "Malware payload", "value": "53b013a69f13c2162b35e47bbd0f9198c654afc96df662cb614fa76a0eb9d2dc3aa12c6e488792c83c24b27fd20ba6d2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "DarkKomet", "colour": "#A9FEE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742270, "uuid": "efcf27fb-d354-42b2-893f-ebd0775c10b3", "value": "T196E48E31F2808837D9721A788C5B92E5943A7E202E39754B76E62F4C5F3D6C239263D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742270, "uuid": "b594f7aa-1c0b-40bf-98da-f3a77b7452da", "value": "8033c11f8a2fdfc317e8655120579933", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742270, "uuid": "a2a57184-8d13-4f8d-8ce9-c8b692699a94", "value": "12288:O9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFH:aiBIGkbxqEcjsWiDxguehC2S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650742270, "uuid": "e8c37b9c-967b-4c0d-9653-baca45c3e567", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650742270, "uuid": "70841c86-2a99-4cd4-86e8-073849a56801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742270, "uuid": "2dfda64d-e3a0-4531-9966-8884e18d167c", "value": "MSRSAAP.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c190a4-c33b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650742098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742098, "uuid": "cc376c5e-91bb-40cf-bb70-842f644c7cbe", "comment": "Malware payload (AgentTesla)", "value": "f21a6dd624a9647f2687dd20adc6b092", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742098, "uuid": "7fbd61f3-3cd0-47ec-9a5d-4e07e980ccc9", "comment": "Malware payload (AgentTesla)", "value": "942a2abf04da0e724edf7e47e8886f2a2801599540b5092d972b1c18ffa4a3ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742098, "uuid": "4e1576ad-ce13-4a51-a60d-c8e64cfea713", "comment": "Malware payload (AgentTesla)", "value": "01f0c10ac85a88ee4acab131e577bea4fba98abc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650742098, "uuid": "94f4941f-02b2-48fa-93c8-ee1ca47f9bfb", "comment": "Malware payload (AgentTesla)", "value": "ed4299ab10d8559af3c67f5cc7b1cf3bd910942ef6a2435dacb0cb10e3d4b715caa96f44f6737794e82cda5db1226be8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742098, "uuid": "c00f44dc-6007-4fe7-aea3-fb9b9f81af1d", "value": "T183A4D01937D436AEE8AB97760A224C64A7353967172BC30E155711ED4D3EBC2CB20BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742098, "uuid": "20cd5579-f7a2-44a1-815b-8a3e6f13811c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742098, "uuid": "c47ae387-0056-4892-8d54-e5ce9e05c552", "value": "12288:d0ngzBLUhRBp3KaGK5JTzvG/PMRWhwXfAn/yBDhcaBuiU:ddLgp3KqLRWhwXfuaBDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650742098, "uuid": "35c136b5-9c2a-4eee-ae23-b97117ba2853", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650742098, "uuid": "4497c8c2-d3d8-426b-9ed2-610af47a2321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650742098, "uuid": "76ed697a-3610-4218-b616-2566a641943c", "value": "AzDKtiuEjUBBXor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd04917-c33a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650741763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741763, "uuid": "448759b5-7460-4128-9342-55208bfee87c", "comment": "Malware payload", "value": "0b8772d0ff23752e9dd5e78ebed2235f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741763, "uuid": "da6d1666-9091-4202-83b1-018a0a8b486a", "comment": "Malware payload", "value": "942ba10a6a86ab1fae15a6f15d8612d02240a2b85901b36cb035eb66d8bcc0ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741763, "uuid": "02a8c733-85b3-447c-8ae4-1eed49d472e0", "comment": "Malware payload", "value": "4937be808751e8b4a4fd54e5522b90162ee5f252", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741763, "uuid": "73004000-fe36-43f9-a933-84121990ddfd", "comment": "Malware payload", "value": "91cc19b9943cf29ab8c2b8064fbe3c488d416673775f687d48a859681f2dde038079f2fd221588915310dc32e29a3475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741763, "uuid": "024e2af7-9e5d-4603-805c-e89a74647426", "value": "T1813623635271115AE0B0CC3EC5277DE236FB13675B82BC7485AABDC227634A0E71AB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741763, "uuid": "a4d21395-c69d-49e9-b9ab-734d55139640", "value": "5406c159820f2775ff902abdfebe6f1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741763, "uuid": "5781eb8a-3fa9-44ac-8d4e-5b8a13c150b4", "value": "98304:rNcSBDzuibYqwmJ3JPI+JBFeMfbkU0x6wUgVWyZ6ALdq5lxhD/l2qzie:rxvNbYqdZPI+JPeMDkUSDcYc5lxhx2YR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650741763, "uuid": "aef24bb7-236d-4487-b29d-4dd017554e13", "value": 5215744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650741763, "uuid": "77d45485-edb1-4639-9146-ed3f9b381688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741763, "uuid": "73476285-9dc1-46ca-bc40-8abeb3a5d399", "value": "snow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca9e15a-c33a-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZLoader)", "timestamp": 1650741677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741677, "uuid": "66e3e052-a3ca-4435-8d4e-791587553e13", "comment": "Malware payload (ZLoader)", "value": "140878cdb1f4ae293cb1d190aac1a67c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741677, "uuid": "2f2e0fd5-78e7-4c13-a0f3-cffecf0a2b95", "comment": "Malware payload (ZLoader)", "value": "942fc3120dd9b425f13052936e37d4c74e09481f80741cf44457494331bc4189", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741677, "uuid": "194e595f-324f-48ba-ab25-a75aa7645c88", "comment": "Malware payload (ZLoader)", "value": "efc38c589d5a7c56fefc14362ddbd5fa28b01d76", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650741677, "uuid": "69e33d99-c5a8-4e84-aeac-ac30b4f59153", "comment": "Malware payload (ZLoader)", "value": "4b8e647712f701cf586af3e8d5920f9817bce6dc140ea2898dd03dc44bc6db7b443f7d69d4cbb9664eb560989754b6a1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741677, "uuid": "79388ea1-a7ca-479a-86c1-212fc559b4a7", "value": "T111F272F3BBC5AC65CE088379486B42A06713EC5517AB938B3384F7263FB5BA04D06587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741677, "uuid": "890e3ce2-22fd-4c45-b3b3-39057dd5bf97", "value": "768:YPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJw8Non8vmSnBu8zYWb5HkDT:Uok3hbdlylKsgqopeJBWhZFGkE+cL2N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650741677, "uuid": "db1e5d36-c728-42bc-80b5-127d67f3a27d", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650741677, "uuid": "389d24af-0a8c-45a9-9119-0418d1e45572", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650741677, "uuid": "3f2c4f3e-9683-48d4-ad7f-d7449ef17589", "value": "SooS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab3b41c-c2d4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650697999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697999, "uuid": "0116fa86-2473-481d-ace0-a371970aa676", "comment": "Malware payload (Heodo)", "value": "9316ee8048406140ad5ea7d8f196f799", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697999, "uuid": "f0c81b97-54d9-450f-8593-3b84cf668cc7", "comment": "Malware payload (Heodo)", "value": "959caa489a49d9e16945fe90177480fb2a9fb5a8fbda88474de9506235f3bda0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697999, "uuid": "91038c6b-f5e4-4a4a-8db1-2107e83be835", "comment": "Malware payload (Heodo)", "value": "ed60ae4ca5e562eb64db4eec4b0822a495508eb0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650697999, "uuid": "49dcd414-b905-44b2-bdfe-7a4b0529a426", "comment": "Malware payload (Heodo)", "value": "16cf4ba23cb93ff252633a9e7cecbd492cd36793d732ec9d9645a2981a0f37f1d5a7020304779c15f02d1dd4443a417e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697999, "uuid": "4e960bce-5012-487e-9f96-d7651caaba7d", "value": "T17ED45B10A2FC82B5E06ED13EC5828B5AF7B13D10D73197CB82518B5A5F772F15E3A622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697999, "uuid": "fc1890e1-f3eb-434c-8960-24499af8b5f8", "value": "12288:35ujMriyfJ/+P+6kxZFHE5+m0BIXEP0Oua:3sjIJ/+OHE5+m0B0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650697999, "uuid": "23f13176-8333-4ed8-a7a0-ad588877bbd3", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650697999, "uuid": "6aae0471-f834-409d-8a96-5fb7d9b9bf2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650697999, "uuid": "b7b95590-4645-439d-87fd-e9377ab0ba93", "value": "emotet_exe_e4_a0266f83bb2d756ff4eb04d1ca38ebe1d7f7747d7b2c3da26ba5c0c9dc0782ea_2022-04-23__071315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59015172-c354-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650752757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752757, "uuid": "9ac0f127-be15-4776-9382-8494e33fdf18", "comment": "Malware payload", "value": "04a682e8cef0fe3f925b3c2e8f0c45c2", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752757, "uuid": "a6cf9ef3-f6e7-4d3e-85fb-dbb76b02a97e", "comment": "Malware payload", "value": "99378dcad6eceb485b013c3392158920f74bfc8a6188672c2873b2f6e53ee001", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752757, "uuid": "f0ccd77a-fbd9-4d1c-9c72-85a61a17a753", "comment": "Malware payload", "value": "95b0b0c40963f3cb3509d94dd5b52594468a1b78", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752757, "uuid": "cb5fb213-c5e7-4397-8c93-68251d09dc55", "comment": "Malware payload", "value": "1072f9b27a663052cb25cd779290bbf937e9b60acf2ed4d1ebe9d25901c19e8bd1d10235f1dd408a8cbf2df524707af0", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752757, "uuid": "41164cbb-4375-4738-9730-4f0b9c87f682", "value": "T1D27723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752757, "uuid": "b334bceb-299c-4f79-a521-fdef7fc7d673", "value": "393216:+ADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8N:+AwwU8SAwwU8SAwwU8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650752757, "uuid": "80ef40d1-8954-41ab-ad08-3226cfa32dcf", "value": 35821568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650752757, "uuid": "4f813897-f068-4572-8831-a3878690e66f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752757, "uuid": "0c895127-d76b-43a9-aba3-e74ac19219ee", "value": "Windows11-setup_11.46576.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587d334c-c2ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650695204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695204, "uuid": "ba910d5e-54ce-4d02-b4a7-97872c361a79", "comment": "Malware payload (Formbook)", "value": "914134bcfe78473c6647d785ceea3235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695204, "uuid": "5447f582-91a1-422c-90fb-cbfd26515bf5", "comment": "Malware payload (Formbook)", "value": "9afa5a53a2f68b1eb6dcc22a14b1b23e03b02da4a5501d7e7cbcb0a4d694f55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695204, "uuid": "4254fe98-cbde-455c-9335-0d2c10fefbcd", "comment": "Malware payload (Formbook)", "value": "791ea911e79bf1768916ca599ca4cc5a9f2a8817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695204, "uuid": "d0e75ec3-314a-4ee1-a80c-68ccdb70d9bb", "comment": "Malware payload (Formbook)", "value": "96dfe9e658688cfa33507277a00736b2e20e95abdd9e93f4bd16579bffebdeb18fba3fee0a1828e224e5e18c87c7bd3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695204, "uuid": "c9ec94a0-0b9f-4931-9471-87bf3bf1fbfe", "value": "T134C43AC934618097E96E2FB1B81EDE7810B22EEDF58CF50D79A17F0733B3681581A646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695204, "uuid": "7f6b0b16-063a-4783-81d1-7f2ac5765546", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695204, "uuid": "230ed263-ce6f-440b-8d09-d0891905d3d0", "value": "12288:ONdUU9s9UIR5CGRdwSL0HCaSWAxSX9ExtkCb4wy:ONLSAHCa3AxPnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650695204, "uuid": "cd0fb9c6-f311-42ce-ad9d-2a8f0a4001e6", "value": 576509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650695204, "uuid": "7d7acecf-94ed-41d4-b4b6-79379b755d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695204, "uuid": "60a5b5f1-924d-43da-9c7a-927f6c3d673d", "value": "914134bcfe78473c6647d785ceea3235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65a3a35-c357-11ec-8e58-42010a9c0032", "comment": "Malware payload (LimeRAT)", "timestamp": 1650754256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754256, "uuid": "06c851b8-197d-47c3-b050-8b13053a7036", "comment": "Malware payload (LimeRAT)", "value": "a4bc10f020549e581242eefdd367cc5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754256, "uuid": "84f83655-9054-460b-a40d-a1bc3b5aa268", "comment": "Malware payload (LimeRAT)", "value": "9ba22c0f43f4c60f3c36b116ccb2a8ed8abd33d26ce6d3d3088dd26392c9f115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754256, "uuid": "573099d3-0723-4651-ab7d-fe44fb768b5f", "comment": "Malware payload (LimeRAT)", "value": "790891ec188c5720ebff59a9f26742b060ac89bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754256, "uuid": "4afd6800-e25d-462a-8d23-65471dbb2c68", "comment": "Malware payload (LimeRAT)", "value": "a8797e09eff33bc21824b3f4d4322cea139ab4d85b27ad4f314a12ad08941a11e3479962e34a6fb9a346e66562ff9ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754256, "uuid": "991bb2ed-1eeb-431e-b32e-e27f4624947c", "value": "T1D9039F0077E18345D2DC29760B7262A50F71D607AD3BFB6D0CC994925EB7AC18ED4AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754256, "uuid": "690c9d1a-e5c0-4dcc-8c17-f44be7272b63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754256, "uuid": "3cbf966b-19b5-4ed0-a550-563fe4a22c53", "value": "768:upOL6TvwdUiHHJ2ivE45Nb8QxaQPejrD9OHz2pt:upJvwdpHHJxJsQ09X8T2pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650754256, "uuid": "3c8e8045-3bc4-439c-9e85-97724d96b632", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650754256, "uuid": "1b95378e-aa94-4891-9a69-bfafb0695751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754256, "uuid": "7920154f-a900-4462-937b-7a02a4d41eef", "value": "a4bc10f020549e581242eefdd367cc5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b98165-c357-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650754203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754203, "uuid": "c5b86fb9-abea-40b3-a4b1-5d2411cf1135", "comment": "Malware payload (Mirai)", "value": "0da0b0eb8899e5c010cd978fcb20c362", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754203, "uuid": "2f607d0f-e82f-410d-90f1-38d44e3408ae", "comment": "Malware payload (Mirai)", "value": "9be633f12d901acb767096dda9589ce5e4042e48021af8cb1c18b6fec7654863", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754203, "uuid": "05b73ce9-ec7a-4b34-a50b-30cd4fc6dc5b", "comment": "Malware payload (Mirai)", "value": "89aaa63f87d5a1576c96c53fe16dc3709ec96f9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754203, "uuid": "0c3c1828-73ca-49d1-bc89-e08e4eee6082", "comment": "Malware payload (Mirai)", "value": "ca9e55e27d32127f42d63d228af5e745418b78c77ee996415a2f673c376ffc761a5bee68c2abd6425851089d3890d955", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754203, "uuid": "77ca54f5-ea58-4fde-ba24-60a28a7cbe06", "value": "T1C2435AC5D693ECFAEC010976217BBF328A76F13E2069E9D3E3995922AD46503D40736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754203, "uuid": "dee34b83-498f-4579-9145-4ff3bc768393", "value": "1536:uq5CIbmgv9j+9tyfHVu/a7qEk4EjeO1xM/Xn:aIbmgvl+9yHs/a7BRfOf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650754203, "uuid": "2acda5d4-bb05-40d1-bae8-8691b79489d0", "value": 59760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650754203, "uuid": "7428ef8d-9449-40bc-8836-38e682190ff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754203, "uuid": "c62614f1-60c1-45d2-9855-08f203a835a5", "value": "x86-20220423-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7617b7a0-c305-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650718876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650718876, "uuid": "05cab3a4-6550-4042-bec5-05bb4e54fc6d", "comment": "Malware payload (Formbook)", "value": "a1fd0892942e9059275dc2e5d54c150c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650718876, "uuid": "409805a6-370f-43a5-a79f-5b5eb9c80602", "comment": "Malware payload (Formbook)", "value": "9bfa0f51aa92cffd6400c97ac2857d1c49087ba5a8ce9d112f8ee5921d714106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650718876, "uuid": "38c0fc57-eacc-42b4-85c6-0f6230972474", "comment": "Malware payload (Formbook)", "value": "c6cfde977f02d1ba5b8893224ad274aa5fe29ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650718876, "uuid": "3a7354a6-c62e-4c45-9c09-f4a3340f91aa", "comment": "Malware payload (Formbook)", "value": "cbf3dbed7c27af4441e718ff8771b970a9e550eee5564dfc6493bc0242ab34e6239896e3127582f1618fecd7382294b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650718876, "uuid": "ac6b9abb-77fe-42cd-99b8-ef157c695e0f", "value": "T110D49DE28DA0254ED9659B38E0C3CCF0E9DCE149606E7788747047176E9D3C0DADE7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650718876, "uuid": "67e350ee-e321-45b0-8848-763c5325a335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650718876, "uuid": "f071b78a-e6f1-4aea-8814-c942d65ff289", "value": "12288:8JrxnuEaLSRADGV0DKO64JEYqJVzqqPsI:wpGuRADGQpJEtJBsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650718876, "uuid": "eae61a96-654c-4f10-ab7f-33b9c1c09c33", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650718876, "uuid": "817a156d-650e-4412-8a0a-cf561ac97bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650718876, "uuid": "37237a66-e24b-4705-bb6f-650b03bfee74", "value": "Revised PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcc28fd-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZLoader)", "timestamp": 1650734515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734515, "uuid": "9f1ac7f6-1ea2-4f0d-8ae0-850a1b0d7394", "comment": "Malware payload (ZLoader)", "value": "feda5ab63c1e053419e68ae79f0edae8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734515, "uuid": "6ee19666-8903-4cd6-b29d-3f24946dbb26", "comment": "Malware payload (ZLoader)", "value": "9cc5c75c665dc1343cb12859f8f825d8d9ea292b09da0d444cb20687c075984f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734515, "uuid": "fa28ba78-bfef-4866-ba2b-731a69597c15", "comment": "Malware payload (ZLoader)", "value": "8b18c194ffd07fe30e4f534dfe6a1d1090d7dedd", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734515, "uuid": "14301f09-816a-496d-b4c1-c84f60ce5202", "comment": "Malware payload (ZLoader)", "value": "bfa30e9e71dcd55c38e7b7d7c19857ce234b7be25775fb3ec3ae4a5f78ec57ad3cf984d825d0ea602ef87aef106fa12d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734515, "uuid": "c1101c72-bfae-40b7-9aae-f9ec2cd1e297", "value": "T14EF293E3B7C5EC64CE48477548AB4290A722EC511BAB93873385F7257F75BA09E02387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734515, "uuid": "901795eb-092b-4305-8e20-7af86f463bcf", "value": "768:+PqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJlbSLXcvMtx:Cok3hbdlylKsgqopeJBWhZFGkE+cL2NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734515, "uuid": "204e0d34-9ebd-4475-9a90-9a70c5070f8e", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734515, "uuid": "361660fc-319a-4605-b90c-7e966ef0610e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734515, "uuid": "c161058b-a790-4dbb-addd-6d3af19466ad", "value": "work.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6481b02f-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650693506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693506, "uuid": "1947c794-0624-42e2-be26-6974e73bfc93", "comment": "Malware payload (AgentTesla)", "value": "12a1c9e356f63cf001ce117fd263c0b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693506, "uuid": "07e7381d-4a61-49bd-87d8-e030be750147", "comment": "Malware payload (AgentTesla)", "value": "9cc90a4e60f396dea5036e96e1bb69a7a9171384038c7acb59f8b3678f808641", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693506, "uuid": "ffbf9c2e-88f6-4793-bd15-a85a95be8d77", "comment": "Malware payload (AgentTesla)", "value": "06a68468c796d73abc5770fa4bbca569d5759437", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693506, "uuid": "b15deb01-3bd9-4740-9b62-2007172e90a8", "comment": "Malware payload (AgentTesla)", "value": "26828dd61fb9dd086a0f441d6924b37bc2f6325ab889839c5334759723afc4ab5472ee346b6d38b87b607b5d34d1af0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693506, "uuid": "92418db2-d14a-4308-8b04-a5a62e00b73a", "value": "T1DBC30217E269A86FDDA98CB790D0833FB4AFBC9B1519C59B606D748D17398C0035361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693506, "uuid": "4d4d0226-911a-42f8-859d-036dde26b7fd", "value": "3072:CY9jIuTjy+1RWB21XEnyJk/2fol312y5mknoDgHlTaaG:dIu3FXWBXn3/tl31romlTaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693506, "uuid": "cc5a9764-7b40-49ef-9c5a-d9e00157a500", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693506, "uuid": "159522fe-512a-45c6-ba68-3a7b84a80a4d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693506, "uuid": "f44eaa76-7b12-4557-9839-e951dfe65909", "value": "Product_List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876bcde9-c354-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650752835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752835, "uuid": "a67137df-4298-4f28-98b4-259b069efc2a", "comment": "Malware payload", "value": "21dd9c8c90af02d75cead08aee689acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752835, "uuid": "dc5e4c88-585f-4762-90d2-2074d1492cda", "comment": "Malware payload", "value": "9f27dace8e848c5957adb0686992fe7ce392cbc7f957116b13935d20e668f91b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752835, "uuid": "327930a3-ec8c-4ded-a7d0-c90ef18e9db5", "comment": "Malware payload", "value": "c337fd07f55bfaa9bcb3e0bb8140d46349bfa3bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752835, "uuid": "1e014bf9-086b-47a6-98f1-a70bbffc9b6e", "comment": "Malware payload", "value": "26f0c3af029274575c6979ec294bbc7fe6ce391b59ed6071c7957cb8750b5b1beaddd9fed376bdd03048646087725941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752835, "uuid": "ea704ac4-d8f1-4f58-9aa9-33147931ac8d", "value": "T1D97723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752835, "uuid": "36054ab2-0dfd-415b-ae5b-9e2f8628b69b", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752835, "uuid": "638045b4-ed4a-42f8-87b7-d730d1b4a6f4", "value": "393216:9ADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw83:9AwwU8SAwwU8SAwwU83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650752835, "uuid": "2e096310-9f3f-46e7-97b3-c2e60bf5038e", "value": 35782076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650752835, "uuid": "ba430a23-7132-4c9f-9232-5aed6c1d4908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752835, "uuid": "4480ab27-ebd7-4fc6-bc8a-0b3144cc2f67", "value": "windows11-setup_11_46576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e4c6b6-c2cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1650694961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694961, "uuid": "8078fca7-0243-489f-8cd1-49be612c52c4", "comment": "Malware payload (Smoke Loader)", "value": "47783719441715470d2c738603867336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694961, "uuid": "60fd4a40-fc05-453d-8fb4-6e108b9af5ce", "comment": "Malware payload (Smoke Loader)", "value": "a0ff76c95137ab124fd2618f5676c48da8cd72cd4cad4b072c96bbc8db262683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694961, "uuid": "fb96992b-86da-481e-b287-773cf67497e8", "comment": "Malware payload (Smoke Loader)", "value": "3eae9174dd3bcb4bf8eb81d789e4bbe47971123b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694961, "uuid": "f7998c4b-4602-4686-bbe2-1ffe8c8a5729", "comment": "Malware payload (Smoke Loader)", "value": "690bc07721026309dff16c8008a1eaca170933ee3de5bb4bcba941a31ff00b6bf0cfa7c8ecaffa7b4d48fef5495f90f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694961, "uuid": "8b1f2370-6fac-429a-bb5f-281566c117a4", "value": "T1FD04AFD136F0C4F3F0B35A3428A0D6625B3BBD62EA75498B27B416AA5E301C18BB5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694961, "uuid": "b4ab414b-ef33-4c2a-a745-caf11ef96563", "value": "30738ce3b8f03f1077d13f9fb20e18af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694961, "uuid": "2057edd6-bedb-41a8-b28a-37d45a9dd761", "value": "1536:6/yVJFmhI2qkI9esYPrL1tFbv7NuUFsvaPBXsG2T0Xq4WrjNWD:6/UFcI27sS7QUKaJsG2oXlWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694961, "uuid": "baa04b69-d418-457a-87e0-efc37307f72e", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694961, "uuid": "071058e2-a1e7-4170-8137-01b6b5b70580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694961, "uuid": "3e2dc1b7-3667-41ad-9209-a214aff63e6f", "value": "47783719441715470d2c738603867336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f47b45-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650693395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693395, "uuid": "1f2aea84-30dd-412a-aade-9348d0fbaa71", "comment": "Malware payload (AgentTesla)", "value": "55ab39ba5b29de1a74c707d2a0b130ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693395, "uuid": "5906f675-5afb-4bc8-a8b0-06f1611aea78", "comment": "Malware payload (AgentTesla)", "value": "a22e1783fa47693258568b77509b250b83c13903879d31e94884463a2cba96e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693395, "uuid": "93a0c50a-6b80-486d-a39b-f0e9c441a219", "comment": "Malware payload (AgentTesla)", "value": "1922edcee4a928acfa1c8d4566a2ded5bb303fa7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693395, "uuid": "30dda3cc-7bdc-4a9d-8797-e17eb7b38fbf", "comment": "Malware payload (AgentTesla)", "value": "d27c9b0d6fb222210c8bc72b76ad1baf4496d53364a28a6c79a375de37970d979dd096822fb3bec95ee88041068f00a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693395, "uuid": "a41996a5-fecd-4016-a4da-5ceca199ca92", "value": "T1EB2429166714D521CB6F417FC016820831F1DB07972AD39F5AA6D8FA2F812CEF92B9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693395, "uuid": "ac28785f-3ddd-4f6b-967b-49602fab1b18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693395, "uuid": "1feadecb-eb52-4c69-9dbf-13994b4f2704", "value": "3072:jGWXpDkfzhy+h4d0aiaIUUs4UHLnOkxsotlBbnkGJlKKQCq6qa2+WQ5z086TUcWW:jVX+h4dhBUOLOkiQ75JllnI+n7iUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693395, "uuid": "7f2aa1f7-f074-40e4-9a9a-1b6a88fa00b1", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693395, "uuid": "1ddafccf-be13-4942-8629-2a1c5e9ed6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693395, "uuid": "8e195e05-526b-4128-9348-bc34e730153b", "value": "55ab39ba5b29de1a74c707d2a0b130ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf643db3-c2cd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650694974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694974, "uuid": "f1cdef1c-e9fa-46e7-b9ab-786289464d2f", "comment": "Malware payload", "value": "43a4ba29d2106cd099b1f82629cf942f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694974, "uuid": "d18e30fe-33b4-4c2a-9539-84bcec0f8451", "comment": "Malware payload", "value": "a381cc51c397bcc0e98d18cf7ec09624481429f37c9c042666d5dfde9d75c252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694974, "uuid": "f551f38a-d30b-40f7-85bb-1b17b53f3bee", "comment": "Malware payload", "value": "57d687d308afd715ce947f058053b9982848d5e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694974, "uuid": "85133cd9-459a-492d-ae29-cc524d111515", "comment": "Malware payload", "value": "796eaf924453b616162855e12fbf3ab7f3ff70e548f3e18af9dd6a7e4403292f40dd96cc1108678c286c7f550b31c9d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694974, "uuid": "a4145d10-6eb8-4313-a9be-76fa555657d0", "value": "T10954026537CF49CDC37C3DB1CC89CE72B824779162795F8323150293A84BAA86B8F818", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694974, "uuid": "d7dfa38c-6d81-44d6-99c9-a31bd6558d15", "value": "66b0e7d125cde526ede4886176cb0f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694974, "uuid": "acc11cc5-d7c3-4e02-810e-099fe09df544", "value": "6144:VwQqP33fhIB0NRxDdDKJyVPMi1GfQNHVDOm6t2KCKF:VwQYOOBsJ4MgGfQJMm6CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694974, "uuid": "b25ef241-637b-4afb-8179-ad96d7ff65e6", "value": 300801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694974, "uuid": "609b5380-891d-4750-bfd9-9ca47b84e2fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694974, "uuid": "98721e3c-978e-4830-9653-2a2077d401ac", "value": "43a4ba29d2106cd099b1f82629cf942f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa6b7b9-c2cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Matanbuchus)", "timestamp": 1650694787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694787, "uuid": "57847ee9-1df6-4f86-9e09-7a91f8b18352", "comment": "Malware payload (Matanbuchus)", "value": "4212658d71d9b01ded5517dd6cfc80cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694787, "uuid": "ec96ebac-3719-46e6-b81d-3a45ebe92bce", "comment": "Malware payload (Matanbuchus)", "value": "a3c896e23c86e47bcb77096e743010546cd7699e0189344d11b9c642b89deef1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694787, "uuid": "59a80b00-dfc8-4b97-8814-a6f7ec8eb575", "comment": "Malware payload (Matanbuchus)", "value": "091dce34d9c527d59cc47bbde0d6b2a43a3169e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694787, "uuid": "b006a033-614a-48bb-ac01-414964cea0df", "comment": "Malware payload (Matanbuchus)", "value": "cf414ae2d670f311b51d3991f9c15503e08bd465fc600c903b2dc0dec65cc0d2c0578467400934f777a41c483d37dd64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694787, "uuid": "8fac67c4-1364-4fd3-87c6-df5e0caaa676", "value": "T117543911B500F132FCBA04759E749AB04A2E7E309BA805CBBE8C7F2E597F5C1A524E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694787, "uuid": "c4758765-628c-4e9f-b82f-4bfe11f87b09", "value": "d86e96cd523f0d88359af350afd73632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694787, "uuid": "9f5fdb95-cf1b-4ba7-8630-8abe65c468f3", "value": "3072:c6mvqcGPwK96Q5OqyaH1MH/oanIAW+Z7fmq9OhqZWXYWrrRSVMnvw84XWpWeZj6H:mvqPn9BOqvmAarWq7fROnMSkdh4sSCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694787, "uuid": "b89b62f4-4257-4cc4-b12d-97208fffd66e", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694787, "uuid": "764ff578-2256-412e-8240-1bf2578afe30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694787, "uuid": "aaedf505-138c-4c36-87c5-90388eb3e60b", "value": "4212658d71d9b01ded5517dd6cfc80cf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fb3ccb-c2c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650692677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692677, "uuid": "fe50d56c-5e97-499e-8a55-209c3113027f", "comment": "Malware payload (SnakeKeylogger)", "value": "a7d2fac6d8297da38b0754db9db5e5fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692677, "uuid": "0afab8e0-77d2-4ccb-bd38-76e3c5b8cdd3", "comment": "Malware payload (SnakeKeylogger)", "value": "a4412bfc73cf38bcb741931f60d510ef8ae020e4212bb714b9a6a83b371ba5b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692677, "uuid": "c81c3521-ccdc-4e1b-ac2a-8e6f74978fec", "comment": "Malware payload (SnakeKeylogger)", "value": "e3aee4751b2cd69cdd4acea951ef6359c080a62d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692677, "uuid": "620b802a-9ab7-44c7-bdf4-d4ea85127298", "comment": "Malware payload (SnakeKeylogger)", "value": "ccc84767d049c40322770b84200923a096616fd50d64034a23981b7e14b0e3e5af1a38f89a74d1e682e79accfb8a864b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692677, "uuid": "9a54405d-dd9c-4c4f-81b7-e9f7527e4302", "value": "T15ED4E12413F84612F4FE5BBAA871560097B5F897D633E75F4A8021E82DB3360CD563AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692677, "uuid": "68e420b3-8097-43b4-bcf5-5d43ce1964a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692677, "uuid": "92f00e54-676a-495b-950f-867e02331042", "value": "12288:WfZIjiqByuj2OTBxT+ZtICHvWfzvYUqThDPfJAK5sHHtwBZ:zBEYftrCHvULq1DnJAnn+BZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650692677, "uuid": "94ff1e5e-6f62-48bc-aa24-ef78df833993", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650692677, "uuid": "1004183f-7529-46fd-a0e0-4443e2c13a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692677, "uuid": "ac181fbb-47b6-4c17-9c2b-d06fc6e117c8", "value": "a7d2fac6d8297da38b0754db9db5e5fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d2883a-c2b4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Erica)", "timestamp": 1650684306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684306, "uuid": "2145ca52-a508-4236-843e-bcba194c5b2f", "comment": "Malware payload (Erica)", "value": "2f21af3173d0ee0960961105945f4fe6", "object_relation": "md5", "Tag": [ { "name": "Erica", "colour": "#58554B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684306, "uuid": "e3659e20-9992-48ca-906e-8e77a7ecbcf1", "comment": "Malware payload (Erica)", "value": "a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844", "object_relation": "sha256", "Tag": [ { "name": "Erica", "colour": "#58554B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684306, "uuid": "51cad475-5217-42dd-bde1-f1b0954742c4", "comment": "Malware payload (Erica)", "value": "6bff623bb8b365575971c7051cca859953a90f7d", "object_relation": "sha1", "Tag": [ { "name": "Erica", "colour": "#58554B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684306, "uuid": "7bacc469-02bb-4823-9231-0efb7e6054cd", "comment": "Malware payload (Erica)", "value": "e4e66af7b5029e1cfc562c67a64f461a83096b1f5f99c6b155102d6616c98a91a5a2dc808057b8db9f0e222fd31ee3ab", "object_relation": "sha3-384", "Tag": [ { "name": "Erica", "colour": "#58554B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684306, "uuid": "08883d5a-da6f-49f4-ad38-50cb67803860", "value": "T16FA37C4EFBD84EA1D6E90A3886F715A62730D016AC93E74F9374F0396CA3F079457528", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684306, "uuid": "dc427d3c-8876-49a5-85e5-3999e307ef3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684306, "uuid": "05b90ce2-7ab3-43b9-a6fe-2d3c51ce92f6", "value": "1536:c/mzjPBTMLJqiUdE2tjyTyyyyyyF8yIyyRGYyyyyyyyyyyyyyyyyyyDmX99dHdnt:c/mzNsJqVC/9xllKwZPyitBmc1yY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650684306, "uuid": "8b60233c-a401-4847-bedf-1ddbde04ca7f", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650684306, "uuid": "d91c6f4b-e331-4876-a386-78ba539f800b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684306, "uuid": "fd09f5e4-ddb6-403b-9b0f-d56d860087ad", "value": "scr.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adcddda-c313-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650724763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724763, "uuid": "e88e5e93-a0fc-4d48-902c-1973037d78a4", "comment": "Malware payload (Heodo)", "value": "50b809bf0ab897f52f58d99726834639", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724763, "uuid": "8a638d04-68af-4afb-ba68-93fbd97873b2", "comment": "Malware payload (Heodo)", "value": "a52694aa3f7f6955a103a02f1a80184c2d2a92e4eba954ba161c4bce5ff72812", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724763, "uuid": "86cc8586-bd41-4bac-ae7b-1ed7725ca7ed", "comment": "Malware payload (Heodo)", "value": "a025820e747dee20d8c3b2bd64d551aef42fd978", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724763, "uuid": "781b8efa-bd7f-4683-9ad1-c5bd1404b27e", "comment": "Malware payload (Heodo)", "value": "028566a9d26687dab7f57cae58e2d400a027f4ec35d60149ca4daa8ed42af9bedaa1420012dfa7dfa6667b0812b5ee2a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724763, "uuid": "71f68dff-e336-447f-abb9-ae9122d5fcd1", "value": "T181C45A117691C936FC8A5F313583857D1FF97F68AAA88227EED03A0D6BB75008E142D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724763, "uuid": "81a1e09e-01e1-464a-a4ca-73d56e89084b", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724763, "uuid": "b82b13b1-7540-4e53-b764-c890ae452912", "value": "12288:bGptged525pthqnhd+RUKyTpoOvHuf27x+xa:Ch525DhqnhOmpvOf27gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650724763, "uuid": "ba6c8301-e31b-47df-855f-b38deefb4cc6", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650724763, "uuid": "956fea60-aa33-4c7a-95e3-273a59302c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724763, "uuid": "54398cd4-6b85-4f93-8841-d2b4f561e75b", "value": "emotet_exe_e5_a52694aa3f7f6955a103a02f1a80184c2d2a92e4eba954ba161c4bce5ff72812_2022-04-23__143917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929bd830-c2cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1650694013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694013, "uuid": "8770114f-d516-4284-b976-da50e144d6b7", "comment": "Malware payload (Gozi)", "value": "ba155d8aed7ca303fcfc3f0248d218e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694013, "uuid": "79352914-35e4-4b7b-812e-31a8b452531c", "comment": "Malware payload (Gozi)", "value": "a5ea92139f59d185548e8f48d1ce65cbf54bf1e3e1930de221091017fd1d4f0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694013, "uuid": "40dc3b54-54df-4dfb-85f2-6013e2d55225", "comment": "Malware payload (Gozi)", "value": "600453c21cdbecdbea9c825df4754b8a1829d649", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694013, "uuid": "59710e93-dca5-44eb-ad86-83f215282e95", "comment": "Malware payload (Gozi)", "value": "1625ca940c70c6e4259362bc3dc7dbb250a5575e9d3f1652c122afb2f3d92dbd4b664467ef488a42f0b4a57a8ea3d54c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694013, "uuid": "250fba9c-c77e-471e-a13e-dc004365ee8e", "value": "T112D4BD1A029B2102EBB6CE78A751636C54574CE09B01E2CFC9190DA395E34FBF4FA5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694013, "uuid": "3b124bf3-8a8d-4efa-b035-3cd58528fafe", "value": "fd1c62e6f93e304a27347077f6d2b44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694013, "uuid": "d13b9ed4-0317-488a-8d42-90f2842a155c", "value": "12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZB:+w1lEKOpuYxiwkkgjAN8ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694013, "uuid": "ea01c906-f7e9-4240-8cc6-55037137b2fb", "value": 640699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694013, "uuid": "cdd068b9-0535-4768-b980-e412003a4bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694013, "uuid": "04d11e5c-b9b4-4c9d-a794-73ab07817d96", "value": "ba155d8aed7ca303fcfc3f0248d218e1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c05b1b-c2ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650708005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708005, "uuid": "8a345b12-0c12-4dea-8ffb-7c6bcf21f6db", "comment": "Malware payload (Mirai)", "value": "54735de3cc9f9f12f89fa11c180a3df3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708005, "uuid": "ad19f6b4-5b68-4e70-ba63-b91f146e4065", "comment": "Malware payload (Mirai)", "value": "a8bd29ba93b578f4a5c1cce133fd0f85577cf7dac0bf2f69287ee088ac1dacee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708005, "uuid": "c877d545-7481-4d78-a59a-5a7a1982aef2", "comment": "Malware payload (Mirai)", "value": "fa44967f00850340580f9ae3ee4d8fd6b301af37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708005, "uuid": "1e8fc28a-f748-48ea-9019-41c3d1e402f3", "comment": "Malware payload (Mirai)", "value": "faed7e871a255479275c26fe27cfe06b410b1df34176d692e0d000aa1196a42b8df199bb47d60b68bf1200106a7eb565", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708005, "uuid": "019df211-8298-4d6d-a0c5-2cbb4944c2dd", "value": "T1E5434AC4F143E9F5E84301741026EF37AF72F2EA115DDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708005, "uuid": "09f987a0-94e8-43e2-884b-f1af4852d67f", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmc7Dj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amUlWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650708005, "uuid": "ca5948fa-2382-485c-900c-8613cc66337c", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650708005, "uuid": "be74fe9a-7abd-4531-a433-a1037e13289f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708005, "uuid": "7fcf1200-1a4c-4cef-a7ce-9fc2e7165f79", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c903bfb-c2cc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650694218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694218, "uuid": "d898bd06-57a7-4b61-9b36-b9269a79b595", "comment": "Malware payload", "value": "3cb770107d667579115e82acd3054222", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694218, "uuid": "68381c30-a8bf-4090-aaae-238677625b8f", "comment": "Malware payload", "value": "a942272e63a3bfa6af948069193179e413d2c3fe9f2df6a6f9cba3f82e75d7f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694218, "uuid": "1611dd3e-7e4f-4d98-819e-d4b222bdff24", "comment": "Malware payload", "value": "95741c0b3a178784b0e6b9fbcf73d4be6206d97b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694218, "uuid": "f7b8a49b-684a-471d-9e3d-54b1fb68b471", "comment": "Malware payload", "value": "7f6506fed1f1016ffd9cfa9b02f8517add09d9a1c5136229bb6c2b37d375b224978b1d043d01590f9730f356d99e4c2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694218, "uuid": "15abc914-8d1d-4619-bf8a-5f3ba528c827", "value": "T18404ADE0BDDA4D8AEAA4927C9DB6D662377DFAD05B538B03557498721B03EC23CC0247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694218, "uuid": "0eef36cb-ca5c-4d42-aac5-cbd9e1db304f", "value": "51927b9948beaa5e438a9b058c04f646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694218, "uuid": "0311c7bc-e4c6-4963-9da1-b0b5cbc24eaf", "value": "3072:5bqVlbIh01te4c2CtdCIu7+RzERXWdz9vBk3ovHZaxTwWN8ZxMRZBJ:glbAmtePb0SzEsdzxzRaxj/R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694218, "uuid": "c019ccfa-2453-4502-91f7-acbf4d54a6d7", "value": 188383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694218, "uuid": "178c0ca0-2e6a-43f5-8650-65dd833a0561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694218, "uuid": "330ea9bc-1961-47b0-9a02-691192e18ab1", "value": "3cb770107d667579115e82acd3054222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9012bdbb-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "410ae946-b3a5-438b-8121-d493d33d31f1", "comment": "Malware payload (Heodo)", "value": "8e90abfa9a89f53aef6e51491d5369a2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "3949f594-3ffb-4366-b697-506116b35fdb", "comment": "Malware payload (Heodo)", "value": "aa5a4e4c827b9badf9bb22e93dc9d4e408e1335ca12b547db16d438ee2a1adff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "b9622c21-3151-4ff5-b81b-48e815817e8a", "comment": "Malware payload (Heodo)", "value": "bb79b2558175feac6ef1c86e2a8b5b07b5fb6290", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "d51bae36-452a-45ce-b0c3-65374f34277f", "comment": "Malware payload (Heodo)", "value": "a2854b9eb8d0a625cc94252c56b8744a0b38e75cf08523fa7722285af79317d39cf00d596737a1f8056e6df7bffe0458", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "4fbaafa5-002b-47ce-b60a-0149f9a0f112", "value": "T18FC46C11F6AC80B5E07BD13DC9A3865AE6713C984B7943C79251EB3A2E736E15D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "3479edf9-2e9d-4685-9f1e-5c36f4c8d143", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "515bdda8-af39-4f8b-a05c-8effdc9b787c", "value": "6144:1oJyHSfFIDAqBcJ6EkVgNazgHH6mXZOs4z7N9nAKieHiL7iinzGCvCsP5Otu:C1FIcocJwMTHzXO7N2KBHiyzsku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672104, "uuid": "ea24b269-d8d3-423d-922b-4a3284585603", "value": 547127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672104, "uuid": "15c11f71-0fef-45e5-b68e-4e5102db5950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "5a2f2f0f-3a14-455b-9086-fab06cc37d8e", "value": "emotet_exe_e4_aa5a4e4c827b9badf9bb22e93dc9d4e408e1335ca12b547db16d438ee2a1adff_2022-04-23__000138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd541a2a-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650693709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693709, "uuid": "7a0db462-7e2d-4976-ba5d-2681ae0d4143", "comment": "Malware payload", "value": "505fd64856df8422a2d570806b3cec7b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693709, "uuid": "7d5973fb-09c2-4cec-8a10-9c0174414c81", "comment": "Malware payload", "value": "afbaeed5f1f82a7604ff145fb8dbcbf2703a03addef464dcd06f3230581303c6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693709, "uuid": "c481787b-4d73-43e6-80f9-b1d2dac64262", "comment": "Malware payload", "value": "58519eb0abf2628cd33f89789dcec4f07e75592a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693709, "uuid": "8b32a7c9-8308-4d9b-a816-319d7071261a", "comment": "Malware payload", "value": "bad453c89a3ea2e70c2cdfab09d88345bbfef5bab53addcb1a029cec73b32c82cf0e76d5b9568c76136c3bc0fe5b36da", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693709, "uuid": "96f645e9-3c2f-436b-b7c2-014463be6d15", "value": "T1F133CAAF3C9B490775EBD8D9F2862CA5E6F49740AE363E68C653871700E9B1EC711843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693709, "uuid": "c1df527e-ce5a-404d-94a9-23f3a0e8ea14", "value": "96:EXp9oQoJIMR/hP7GpAyDR+By/08JkUyIUMFypN:6IQ7M37SAyDRy+6+YN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693709, "uuid": "7c373c38-f408-4f5f-996f-a5b0bdd30b4a", "value": 51505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693709, "uuid": "eef4bdf3-e135-4233-b57c-cfd196b10fbe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693709, "uuid": "feba16e5-64a2-4302-bd0e-0c1e42c2c7c7", "value": "Info_Releve_DI0215586001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1aff6c0-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672215, "uuid": "9f468197-72b2-4cec-bb55-e21d7cd2398e", "comment": "Malware payload (Heodo)", "value": "3847059eedb6da784d774a40624bf40a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672215, "uuid": "52f7eeb5-ef1f-4a1f-a55e-04ec0f623a08", "comment": "Malware payload (Heodo)", "value": "b16640ca2ba5f7d2df7ca94a920877a439ae43be30d30a3656e462074ac2b69c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672215, "uuid": "2eabc4a6-7b83-4857-945c-2f8bd36c0782", "comment": "Malware payload (Heodo)", "value": "fb5531fd00cec9c3ff27f37e9591dfb27ffa4e5d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672215, "uuid": "85c77fe1-778e-4a2d-8572-eb506281dd81", "comment": "Malware payload (Heodo)", "value": "fb479624b5a94a961fb6168cd2f73f6175adb6e7366cc2edf31e56e3b6b1dc6dcd70312741c8fc9a72311e1140fd570d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672215, "uuid": "00cfc9cc-b2ce-468d-b7b2-c6e27077b968", "value": "T182D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672215, "uuid": "8e818804-8d99-4c86-83cf-292a9e682876", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672215, "uuid": "68bae2e6-4ab8-4dc1-b2d2-d6500f447138", "value": "12288:C1FIcocJwMTHzXO7N2KBHiyzskF1CubVnmn:tco9MTHzXO7Nj/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672215, "uuid": "b35e40f6-ad5a-4b38-82e7-2d01143735d6", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672215, "uuid": "3bcb6dc9-2ed1-429b-9023-5410a1fcbe1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672215, "uuid": "c7563f48-e2e6-4451-bb63-5b9c0eebe01d", "value": "3847059eedb6da784d774a40624bf40a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dc4d0b-c313-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650724880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724880, "uuid": "06c358bb-5c35-4dce-9e6a-401d776f349a", "comment": "Malware payload (Heodo)", "value": "e2ed81210df21d4921ef7e2376b0469f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724880, "uuid": "3d01dc6b-dc17-4ae6-8609-8f12fc522c82", "comment": "Malware payload (Heodo)", "value": "b1b94e00e04de5ce679ce91278a91bd3b1e174c8efb0cc61293c9d0563418dda", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724880, "uuid": "42f2d2ab-5f9f-4a25-83f6-d6d30ffc4d93", "comment": "Malware payload (Heodo)", "value": "21bf6b661479a98ceb90bb9bba897c73fd663ec3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650724880, "uuid": "b82bf500-bb11-4503-abe1-6b847480d738", "comment": "Malware payload (Heodo)", "value": "cbd0c37d83606b86d83bafac28f183728d31cd03325e4b35fd9a5e5475cb315a1e388db83d2295a6391c3efe213fcd7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724880, "uuid": "1aa53e2a-6823-4780-a17b-354a9dfa278f", "value": "T1E6A48E8B7ECC80B6E15E12373847B675B662ED104AB4B2C37E63797DDA3B5510A2D103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724880, "uuid": "3734da4a-9c32-4ed1-b4bd-9f591e28f966", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724880, "uuid": "fcbc5c25-5fa0-480d-b11a-7f2cc7b3f32e", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzKipvdR4oe9PSji13ugTeoD/E+VE+X:PkxeI6LQF+wlooe9aji17Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650724880, "uuid": "3d7b82a9-4306-43fb-ad77-bbc4b80f801d", "value": 460816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650724880, "uuid": "23c04698-8a85-46a3-a154-8612b270a62a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650724880, "uuid": "c5697871-4665-4017-a688-9f0fc1d4fde4", "value": "emotet_exe_e4_b1b94e00e04de5ce679ce91278a91bd3b1e174c8efb0cc61293c9d0563418dda_2022-04-23__144116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b5d9fc-c2ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650681541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650681541, "uuid": "5b4af0f5-ec94-49c7-ba0e-f79b421a6d30", "comment": "Malware payload (Heodo)", "value": "617281dfc3bd026c97e1b9436317f2b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650681541, "uuid": "9091176d-c2da-49fd-a2a1-9a3abb472973", "comment": "Malware payload (Heodo)", "value": "b27bc11ce91fb619892bf2ff8813c35d667812b46b98b25fcd4536d79fd39fdd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650681541, "uuid": "9e0bf248-d57d-4549-aea7-f818278b9708", "comment": "Malware payload (Heodo)", "value": "c7f89e26cfa92cd5338ff95f802d53f98cf4713c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650681541, "uuid": "e813b2fb-4a68-4711-92be-c8f265cf2a98", "comment": "Malware payload (Heodo)", "value": "411d759dc9eb9be6aee799e7db1bbd4499c19c6ba9cc43c0c11868881f67e0dbf828b1e7ba148d2dc67a417799972ab8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650681541, "uuid": "71ab1722-0dc0-4a1e-8d40-26bc0bb9b6d6", "value": "T17DB46C0273C390F0C657A574840FD525AC77B83C6B19857EA28BA26F4BF78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650681541, "uuid": "0f29a497-0d8b-4eec-b901-a826df46635a", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650681541, "uuid": "cfe68f81-7916-4f05-8cc5-9fbdd5240ac8", "value": "12288:S54yM33d3q3Z7BogxreNmF+U/9JckIAGp:SKh3831BobN6+ADcki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650681541, "uuid": "fc691485-e8be-4589-a11c-3db10024ffdf", "value": 517832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650681541, "uuid": "98d9c881-9559-44d3-973d-23b113511b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650681541, "uuid": "a00e5528-ba03-4d05-9e93-81b637824195", "value": "emotet_exe_e5_b27bc11ce91fb619892bf2ff8813c35d667812b46b98b25fcd4536d79fd39fdd_2022-04-23__023856.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c6ed0a-c324-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650732369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650732369, "uuid": "76ee20d5-a569-4da4-8d99-c5b8791607d4", "comment": "Malware payload (SilentBuilder)", "value": "d300bd72434f52114570a6f7b42e89f8", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650732369, "uuid": "a81e543a-ab78-495d-8034-517844e523fe", "comment": "Malware payload (SilentBuilder)", "value": "b34e44a5dc3fdb0d7af853686a3082eacfe4f16a7b80f797bd490ddea4b5fc2a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650732369, "uuid": "c96c20da-1b3b-44a4-a1df-f63c9ac027ca", "comment": "Malware payload (SilentBuilder)", "value": "fdda292fac5256d2be417765aa91a750f400630c", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650732369, "uuid": "efbc8511-57e0-4516-a25b-8f1b88dcd81b", "comment": "Malware payload (SilentBuilder)", "value": "ca296bfe688c5ade3076fa8821537d9b6d36d4cd0cfe82d023702dfabd296e36a3f78e3af9ceb7ec07d70b92e7430189", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650732369, "uuid": "544941ac-7be3-4e96-8c1a-aec73177999f", "value": "T1F423B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650732369, "uuid": "ef29d727-2940-4cb0-ab75-24d52e18754d", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF6:462tfQXi8vgLZkTOHkQT51Vp6AwPe8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650732369, "uuid": "092adbf6-1991-4a71-aa90-8a0ac2bac922", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650732369, "uuid": "ee7397be-7636-41bc-9480-aa07a69248de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650732369, "uuid": "4fe71c59-46d7-4a60-8f15-b218984cfbad", "value": "2DGW Wire Transfer.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd9b82d-c2b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Zeoticus)", "timestamp": 1650685174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650685174, "uuid": "4db3dd9d-afea-4a71-81b7-2e3b4c20713c", "comment": "Malware payload (Zeoticus)", "value": "0cbe2007f4f89d7b78b83e92bcc7355d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Zeoticus", "colour": "#8DB448", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650685174, "uuid": "a995f05e-4850-40a1-90dd-bec8dc660779", "comment": "Malware payload (Zeoticus)", "value": "b541a9f64fe12c31fff460ab0deef392a8441eeb102805ed578effc6e6eaed96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Zeoticus", "colour": "#8DB448", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650685174, "uuid": "2e57198d-252e-4ab4-8e58-b3ccd73c36c2", "comment": "Malware payload (Zeoticus)", "value": "a5537c7cae031521b8dec2343d3d3c5914649dbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Zeoticus", "colour": "#8DB448", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650685174, "uuid": "589b5f23-0eed-4862-9f83-20bdacc54f57", "comment": "Malware payload (Zeoticus)", "value": "a15f1fcb376ac40553679d48e5781fc305231cda78afd5d8d9d178b2f544594893eff3ed8dad1ebfb1542cbdc335d31c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Zeoticus", "colour": "#8DB448", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650685174, "uuid": "2d4d3a1b-dd95-4919-998d-6f7a711d9417", "value": "T1A36302F4B70A1D566583C355ACE366BA101173E06189DAEF21E5EC8FFB595E0B0B20DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650685174, "uuid": "c516b580-d97d-4890-a0b8-04af2627eedd", "value": "1536:Y1PRKp+3vqKER4L7uJUhUOstSXmJyuqDdUqnzTV6AHIZ/zFlSch:Y1PRYR4Lq1PtWueNnzTV6AoZZlLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650685174, "uuid": "8404707c-727e-4469-af76-84baa027303c", "value": 68196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650685174, "uuid": "77e0662e-6683-46e7-b1fe-f0a56932bfce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650685174, "uuid": "5079046b-e44a-4907-83c8-40636f2621dc", "value": "Trojan-Dropper.Win32.Dycler.zgu-b541a9f64fe12c31fff460ab0deef392a8441eeb102805ed578effc6e6eaed96.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a7385f-c349-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650748240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650748240, "uuid": "92ba3cea-e196-4783-af0d-b41544482ea6", "comment": "Malware payload (Mirai)", "value": "97b9fcdd5a1bb095fbc6e47aee82efdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650748240, "uuid": "e37301f3-d555-4202-9e9c-dc26bd2b6c85", "comment": "Malware payload (Mirai)", "value": "b711e77e51df4b14d46bdaecf02be8c7ef1ecb3f6482b178b0b1544324fb3c0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650748240, "uuid": "d2baecc8-fd8a-4a31-a1ed-46f9c8096e04", "comment": "Malware payload (Mirai)", "value": "a39d9ce5b188d75e6310486020b15da4c781ad57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650748240, "uuid": "36822741-eb62-4c0d-8bf4-523893039930", "comment": "Malware payload (Mirai)", "value": "09c6581c58bbc69097035bb902943519e2a50a5d0da59a21ded87977c573f6b931254a31f9ba04db801782af57ba2d43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650748240, "uuid": "aa4f0172-82ab-4961-9410-8c53c9e0702b", "value": "T1CD03F150CAF78324C6A4213C19DF250E66427ED676DC1D1776B432AF1BE5D2AAF1C381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650748240, "uuid": "eadf9516-1439-4fa9-8e58-58188ee3a633", "value": "768:YK7RXXMbqA/ZDvN7CXTPsJ2WFilMQwAsTpBpkPOnbcuyD7UHQRjJHs:DMbp4PwnFMrwAs7WGnouy8HyVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650748240, "uuid": "cd6131ed-2243-41ec-a228-bcf98efbe296", "value": 40732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650748240, "uuid": "a2088d56-669f-4098-a614-b5b5dd21d058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650748240, "uuid": "0102f54d-8681-4a60-9bbe-7e7dccefc8d1", "value": "97b9fcdd5a1bb095fbc6e47aee82efdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5955762-c2ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1650708299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708299, "uuid": "d515a688-1f00-4a7f-8b31-d30cf6180c57", "comment": "Malware payload (Amadey)", "value": "7f59cde1c640e0eafd551ba198fc9d75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708299, "uuid": "c4075f54-5f73-4f18-afe7-972ebd946f82", "comment": "Malware payload (Amadey)", "value": "b86ac00c0045f91e93bf43c315b7e2a24dface05c48ae554fdcf77206be48976", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708299, "uuid": "db6fe742-22f3-467f-86b7-52512f893c97", "comment": "Malware payload (Amadey)", "value": "38484d722216aa5596fec55bfebc7b244d6a75f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708299, "uuid": "e12e871a-6803-490b-a25a-5a3539dfbdfc", "comment": "Malware payload (Amadey)", "value": "dc327cd3bcdb3fcb09a6d81ab9d7804f71e5e0264f04b5fd7b35331499551f9c3bd83bb0fd08d2b288856e1d7923af40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708299, "uuid": "aabb6e66-ba2c-4094-a600-c2b1a513e08c", "value": "T140C36C73F1D08872D0B10E7CAD56E2D86A7EFE202C351657B6E94E4D693B2C2295D2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708299, "uuid": "101b15cc-cfd5-4aa4-80ec-20193721b474", "value": "557f0c64436e04f97f66ceeb0911cbf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708299, "uuid": "2b135c66-eacb-41be-b172-ce4d79d6d615", "value": "3072:ox7p5EJTJrPwdV3Iwu3fHWSFlI7gQ+mLEeiWSXy9:ox781rPwowu6X+mL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650708299, "uuid": "8fca65ed-68e0-4af9-837e-0b0dc3b6965e", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650708299, "uuid": "5a33c553-d55e-4e83-b62b-755513b4f4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708299, "uuid": "56cc324c-e7f9-4eac-9112-389c24161614", "value": "7f59cde1c640e0eafd551ba198fc9d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74833e8f-c2c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650692674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692674, "uuid": "d9d57445-0596-414a-9919-d90fc42c7d2f", "comment": "Malware payload (SnakeKeylogger)", "value": "917749e72d1df5d451908a5aa5924194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692674, "uuid": "a9f0fac3-d775-46dc-91fc-64e4864513ca", "comment": "Malware payload (SnakeKeylogger)", "value": "b907e9ae608c84134b3143a984950b247c7adf92e4fcaf9e46a85031a9c65d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692674, "uuid": "b256d110-8355-4c4e-a0a5-28afd9ba3e3a", "comment": "Malware payload (SnakeKeylogger)", "value": "b2491a838282d74c5524f2eaf83044ace7c648fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692674, "uuid": "c63cf0c4-5a98-44b5-81d4-1cc21dc2a9ae", "comment": "Malware payload (SnakeKeylogger)", "value": "b9b9060de74d3d8d5cc7523a63da7f9e90b21c8557d1ba3132d5901595aa36b5d31ab652bfd8045c668dd483037939dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692674, "uuid": "7f78f900-ba15-4073-ba93-e0634b5c4e44", "value": "T186053CD1F15088DAE95B05F1BD2AA5302497BF9D54A8410C56AEBB1B76F3382309FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692674, "uuid": "097dde3c-fe6b-474d-8a62-358640de8375", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692674, "uuid": "268d3fe2-43bb-43d0-9bd5-710be7dc22d9", "value": "12288:kRAYtv/hC2iNfgjjQ5mNY2COx3HTkk7MI0lcsZSSHWgm6WGPucEI:+BdhC1tgjjq8MI0l7Z/Hc6jPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650692674, "uuid": "d7a51c61-7789-4c5a-9dd6-f77fd2ee63db", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650692674, "uuid": "e83b2fb0-be7c-4a9e-8e69-b1682a117244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692674, "uuid": "7ff70c09-d8ba-46db-90c7-98a228f094b8", "value": "PAGO y ORDEN DE COMPRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba3d607-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650674593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674593, "uuid": "616b21fd-4e4d-4ad5-8bdc-25f0ee1f5bb4", "comment": "Malware payload (Heodo)", "value": "6070bedc5e07c5f2214ba526582775f0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674593, "uuid": "f48ca864-c927-4a2f-bf9a-67b9c3fe40f1", "comment": "Malware payload (Heodo)", "value": "bc492bd5e74861d65c8a6d17a0926b7c95aad9a02faa839fecaa4b751c48e12a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674593, "uuid": "0a88c97b-d31c-4267-9be4-dfa2889f1898", "comment": "Malware payload (Heodo)", "value": "f0322e1189c90274a2260c3d80b7262e3453c464", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674593, "uuid": "333b92e6-7bf9-4007-a36e-a6c0a53bd3f2", "comment": "Malware payload (Heodo)", "value": "81aa19d5add4156146e6014384f62bb5e94a9879f8fdd0ef0915de786f512351a0e9e6df14bcd85503acfa71540b90a0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674593, "uuid": "a9873b82-e30a-4e90-9ccd-687c1f603e94", "value": "T129D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674593, "uuid": "57e5937c-6ffc-4adf-b549-ca74402efb73", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674593, "uuid": "d873b107-9d0e-443f-9064-b1b304d2e409", "value": "12288:C1FIcocJwMTHzXO7N2kBHiyzskF1CubVnmn:tco9MTHzXO7Nl/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674593, "uuid": "2dc37358-a502-46ca-a836-a7faffe8d263", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674593, "uuid": "1ecf3879-48c4-49b0-991e-89d01179acba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674593, "uuid": "9b23fad6-a7a5-41bb-85ae-fda49abe2144", "value": "6070bedc5e07c5f2214ba526582775f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299a24f5-c2b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (FFDroider)", "timestamp": 1650684388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684388, "uuid": "02da472d-6895-46dc-97b7-7b6f7581f2cf", "comment": "Malware payload (FFDroider)", "value": "54fc82a9b31afeda471d20272833cdc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684388, "uuid": "5e467e63-d799-4478-8f87-8c370899c7b2", "comment": "Malware payload (FFDroider)", "value": "bd842d2f03fdfbed6725d55bee22a568c30355794500528fe820b851fa5d5c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684388, "uuid": "58673af8-ff55-4761-9218-738f0db90e1a", "comment": "Malware payload (FFDroider)", "value": "db9cc826375b8f05457d94af761c9e59cea5b094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650684388, "uuid": "cb464719-e45d-4bd8-b40e-d85e49b34dbd", "comment": "Malware payload (FFDroider)", "value": "aa98466366cdf01102c3ba54aee2bddae00503f531c87398e73ef1f12ac0d8f3ec4b590cb8f8802098a8aac274a0489f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684388, "uuid": "f8ad12ad-2a92-4abe-9846-831a08230c65", "value": "T182463362B2E41835E6740EF4B8B5E3A01C7E7E301735C18B4391B97B1570D926A3BB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684388, "uuid": "6394ca98-36f4-4dd5-9b42-48dd0ca8a677", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684388, "uuid": "d1f8a35c-5a7f-4968-9a0b-7c52b4f1dc9c", "value": "98304:4KbCu4q+BPwE0RIDOukBg/U/J57hwv6ME0s8chcsD9HfMkmSZcTTmrDLknygbS3Q:4aEpKE4G/y7hwv6D0SN9/eStrobS3b12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650684388, "uuid": "b7a55426-2655-4f8e-a904-71df486c8569", "value": 5725819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650684388, "uuid": "17d96c2b-204e-4a81-acb3-fd0b32911ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650684388, "uuid": "cc4600fd-3dab-4c87-9309-794278d9adb8", "value": "BD842D2F03FDFBED6725D55BEE22A568C303557945005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ac29ab-c353-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650752245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752245, "uuid": "b3c024fb-e15d-449b-86af-186302ec28cf", "comment": "Malware payload", "value": "3580f6a43d4fefe44511af143ed29cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752245, "uuid": "139834ee-7f9d-4603-8cfb-74a09c3f051d", "comment": "Malware payload", "value": "bda5bd9df17bef6b97dfafa16a73d0a690b7b0548ee74e5cccb13a9d73b18877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752245, "uuid": "389dee78-6ef0-4ca8-a00e-a0bbec61baee", "comment": "Malware payload", "value": "3540c8049a63d546b166f357ff4e058f529ebf6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752245, "uuid": "07b87050-1361-45f4-aa17-d7211462e5de", "comment": "Malware payload", "value": "6bd7d10c15aa8f77420bfbf839ee957fc083f0aefd2a83593ddb33aa51a574d0e99bde3bb283fec30c6f446616ce27a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752245, "uuid": "013fae4d-9f6e-4b7e-9888-6ce404428003", "value": "T1BF8723FBB258653EC45E06324572923C4937BA6D6BCB8C1A47F30D1DCF2646C1E3AA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752245, "uuid": "0a43ad33-2036-47e7-8c03-2f0909b2c502", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752245, "uuid": "beb7409e-e99e-4d9d-9c0c-ba97a4581932", "value": "786432:XkHiLGD67reN+8kkHiLGD67reN+8kkHiLGD67reN+8T:XzGD67rePkzGD67rePkzGD67rePT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650752245, "uuid": "55dd7161-9c6e-4da7-a1fc-dde57d6c3e76", "value": 36050177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650752245, "uuid": "6ec8e82c-239f-48b1-ae94-95d476930663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752245, "uuid": "4ece7760-81cc-4c2c-bf0d-eec9ff7de2eb", "value": "windows11-setup_11_45288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddb502d-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650674624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674624, "uuid": "4f530ba4-815e-4368-9a69-3637f873dc58", "comment": "Malware payload (Mirai)", "value": "7a994cfd2e91ec8a519183af447febda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674624, "uuid": "bc5ccbed-93ce-419c-8d03-6ac8135624cf", "comment": "Malware payload (Mirai)", "value": "c0391b902756b4c4dd2613ffb933c26cb373ebb1040877655cf06d81d168817f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674624, "uuid": "d83f4528-d554-426c-ae63-bd56be4b506c", "comment": "Malware payload (Mirai)", "value": "42977c30f3f8e0e3ef5bd05c0615b22221d73259", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674624, "uuid": "8638acec-95ae-495f-a0c6-469b6a732ab9", "comment": "Malware payload (Mirai)", "value": "088b683200351a9014ffebcdcf61f37474fc94fba9e7a98243367378537f1929c136bd806a6828bd5b6d23441b9075c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674624, "uuid": "510df025-5a0f-44fe-b2c8-9125221822dc", "value": "T1F7734A45B8818A22C6D513BBF66D528D3B2563E8E3DF3203AE611F513BCA42F0D37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674624, "uuid": "e9a99380-ec75-40b1-90e1-6196c8786b78", "value": "1536:6J/kzXRuE1z4hKHEINcO2+Pd5PhmrFR3GYHELtlut20W5QB3na10e:6J/kLSiyRRW+Exst2rQ8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674624, "uuid": "992c1b37-255a-4ceb-bcf7-cac5c129ba91", "value": 80352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674624, "uuid": "17fcfedf-aadc-48df-83b1-8ed36e4fcde2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674624, "uuid": "adaa0d35-9b80-4f05-9f0e-ddfa3f69f8e7", "value": "7a994cfd2e91ec8a519183af447febda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e216d0-c359-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650755140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755140, "uuid": "d1289b9f-9bed-4402-9b90-dcbe15f605d3", "comment": "Malware payload (Gafgyt)", "value": "dabd60f8e3dcee9ef12967b6abaad4da", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755140, "uuid": "553bac27-e649-40b4-acbc-77e0294297fc", "comment": "Malware payload (Gafgyt)", "value": "c1f187384110764f54127155d896a87aa5385ce36f1af1d6e54c32de1d38a8cd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755140, "uuid": "6ed37d5f-d4e7-43b4-9367-e4c8f0a7da36", "comment": "Malware payload (Gafgyt)", "value": "6698052b05c9a48f64e66182a69caefde8fa8d2b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755140, "uuid": "3899deb1-dce6-4510-a71b-de736e9aedc0", "comment": "Malware payload (Gafgyt)", "value": "1d554c56888d224271d756f13f85eca552dba1605a237b8fd36baa6359071ffdd502e2f5ca8a3028144f8a2419f81bf4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755140, "uuid": "a11f7ab1-b055-436a-966a-a73351d3b1fc", "value": "T1B403E1FB12BB94F4E4335973409916C17E63941D61196E3B2CCB603F8C6A28D76B2ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755140, "uuid": "1e004fec-9b7d-40e4-955f-324e0b22647b", "value": "768:xnsU4xZVmEMG5Wu3PTfzwPfefhnuKTgG+tBx08KSGDCD7:dcF6G5WAPLzYop/+HJLGK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650755140, "uuid": "414ee784-0785-4d81-a47e-0df0909d73b5", "value": 38008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650755140, "uuid": "6a72a36c-90e3-4388-8093-76a39c5066c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755140, "uuid": "b26076b7-af0f-4b9d-bc97-037738d03b3f", "value": "dabd60f8e3dcee9ef12967b6abaad4da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf3c9b6-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650693494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693494, "uuid": "6245e863-e396-4789-97d0-5296637e4c3d", "comment": "Malware payload (Loki)", "value": "da43f5e8c01e1fb42e46b78ba8490eb3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693494, "uuid": "9ef51c2e-22ff-42a8-a3e5-17ecb43967a0", "comment": "Malware payload (Loki)", "value": "c3fb5fff70d936b10ef3838d6adf56fca9166ee5b7e2c9636cb955c7faaea2a9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693494, "uuid": "f7663391-dbfe-4e44-a80d-f6bf705ea682", "comment": "Malware payload (Loki)", "value": "b0f1f6e14f5c5e3d4bcd478170c92c1c32690136", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693494, "uuid": "87b82ac6-27dc-4c57-a830-59c2d9f9e449", "comment": "Malware payload (Loki)", "value": "4e5dea83738c9a20bf8fd9283c6289035d292dcb746d06cdfdb5b0154c9591269dd9d89bec5334e827af4908243101be", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693494, "uuid": "db26997c-50db-46f2-8939-18449a33a50a", "value": "T17E841388FD9D6FFAEDA3817954E2C2E75028ECE65751078365CEB1242373AE6140EC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693494, "uuid": "ca01919b-9590-4e92-95fa-ed928b604848", "value": "6144:bW9S0UIAWro6cLm+8RNgp6aWRckSiP/fP6E78gGiv6EjNG27oMdVIvOKJnYaglsq:K9FN2mBzgpcginfGiv6t27pVIvOyYagC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693494, "uuid": "131b283a-375a-4f18-a300-abff831880fe", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693494, "uuid": "d9fd862a-ddd1-4c35-acdc-043e86ac27bd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693494, "uuid": "9c52f2fd-04d3-49b3-ac84-5c154f5569cf", "value": "Purchase Order - W\u00fcnsche 240010.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913254a2-c30d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650722357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722357, "uuid": "afb00a9c-f61e-45ef-82f3-c4d464222da0", "comment": "Malware payload (Heodo)", "value": "2ebee90fefd4d8b39fd3932150886987", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722357, "uuid": "1c3baa04-ddb3-4f8a-9ec6-1fdfa05964f9", "comment": "Malware payload (Heodo)", "value": "c52f64f193798385614e7099931fd642e8519f723d8505a9e740fbc9b65f4272", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722357, "uuid": "a27a9d96-8747-4577-83cc-99aed2e5be32", "comment": "Malware payload (Heodo)", "value": "43c1c1cde42791c79e24e8a1f37029c2045bd7d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722357, "uuid": "6e087375-d560-493e-9448-82023ef275e7", "comment": "Malware payload (Heodo)", "value": "ea6271291b642b7cf91dc938a876492cd731ac04e3ae4157febf6ee493beed498b28a1d713c099b9f609486d76dd5c27", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722357, "uuid": "59d632ab-27b2-444b-bb96-6135ab174d57", "value": "T157348D11B6C5C473C2AF03360907CB2973B2B6508FE5D683BFA19E8EEE319965A35345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722357, "uuid": "4c8c37bd-5c1d-49bf-a1b1-3af80690de66", "value": "00527f58aa0dd3e43dc95b9f7ec54d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722357, "uuid": "602f5256-e730-49c6-8c1c-dc914b7c81f2", "value": "6144:PACAdVxYSBw26kcI6LQF7q7pyDzKipvdR4oQ:PkxeI6LQF+wlooQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650722357, "uuid": "fffd7eda-471e-47bc-8443-e6c0a1065b54", "value": 246928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650722357, "uuid": "6ff82c15-ae27-4c63-9c2e-729db845b831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722357, "uuid": "69a7221b-492d-434c-a57c-402d4fdf53cb", "value": "emotet_exe_e4_c52f64f193798385614e7099931fd642e8519f723d8505a9e740fbc9b65f4272_2022-04-23__135913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61346d76-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650693501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693501, "uuid": "b6046b1b-3caa-4af8-9ca8-efcde25e2355", "comment": "Malware payload (AgentTesla)", "value": "87563fd61e65423fea64592d1b11f7f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693501, "uuid": "ec2a514e-2940-4319-9b34-791ee425ccdd", "comment": "Malware payload (AgentTesla)", "value": "c5ca55ebf650a73fcfce3add0cb3e907557c9d0f0217e4e4ae33c8b15c6e2757", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693501, "uuid": "d59edb02-4d49-44d2-bab3-0346943c15cd", "comment": "Malware payload (AgentTesla)", "value": "c5605f324ce3c4b67b634812ad0a76ddf3948107", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693501, "uuid": "a28a4fbb-60ff-4f50-909e-23352ed120dd", "comment": "Malware payload (AgentTesla)", "value": "7b16f8c659d33df592ef5eeadba49f83166e7841fad25607e5ff332675563ac5ccda075622568f3d8a4f5aaf09778caa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693501, "uuid": "9e4693a3-eec1-44c6-a9f9-c53a607cf89b", "value": "T1A093F17BA790F8BDF6A4EA7D6550ADF64CB6EDA2E181409CEB3A75DE0C3000F0065529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693501, "uuid": "c9e42ec7-fc36-4652-bdf7-007846ee4c8e", "value": "1536:QMbGurk0FXbMfAzhTq+ZNpAbIlPdvpHJzNbEAU/IuTdxgzDOQBr7ySHx:QMK90FgT0NpikZNIhxpxiVr7XR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693501, "uuid": "88a0a9be-e5c4-4670-9c14-e0dc6470fcdd", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693501, "uuid": "d2686c54-927e-4487-ac4d-1d2f39013d6a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693501, "uuid": "d64e72c2-c332-455d-85e4-edaeb2c3220d", "value": "DOCS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ae01fa-c2d1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650696674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696674, "uuid": "d8958737-185b-462f-b195-a483dbfb217f", "comment": "Malware payload", "value": "e72dac079247ec5ee9aa0f04e02b5eb8", "object_relation": "md5", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696674, "uuid": "4f519d24-1ed0-458f-82ce-464830df6cfc", "comment": "Malware payload", "value": "c6c2d70b69746d12c5a0d1dafa8f8f180624135467e4fd3dbf8df7814754b581", "object_relation": "sha256", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696674, "uuid": "1e821cbe-9210-490f-aff9-0a7f19996e63", "comment": "Malware payload", "value": "fc8f701c6e9622bd133348973ae45d35220d5472", "object_relation": "sha1", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696674, "uuid": "ff89585b-2ce4-46d1-8853-e75f2495d036", "comment": "Malware payload", "value": "e2c0ea93ac773ad5b3fb590ef9827fd307484db7dd3d94094a32a75657ce47cf6389663d0ab9018bf03597ca428e8b64", "object_relation": "sha3-384", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696674, "uuid": "6a7923f4-2685-4e10-8cd2-c1b80a18f8f9", "value": "T18F41DC242BD41334D3718D7B583AA3454A36B946F872DF6D01A495CC1C64604EC34F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696674, "uuid": "2bb47070-e569-46d4-b50a-5cdcdb77bf44", "value": "48:8Df+PLXwjEYgUiAaeUiAWlUvgGOWwUKXv3sY:8D2PLuEYg3y3jDGFwUEvsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650696674, "uuid": "3baadff5-9072-4af7-91b6-cacaf57feb2c", "value": 2393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650696674, "uuid": "f27fa983-2481-44bf-8a9c-e597772768e2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696674, "uuid": "0fc1484a-f196-421b-be6b-7713247dccaf", "value": "c6c2d70b69746d12c5a0d1dafa8f8f180624135467e4fd3dbf8df7814754b581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b28277-c359-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650755106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755106, "uuid": "9f8740ff-7b5a-47a2-be77-e9740b44a7f9", "comment": "Malware payload (Gafgyt)", "value": "540d241293edeabcb4b18825731b24b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755106, "uuid": "cb4fff67-0220-4a7f-b669-57b961069329", "comment": "Malware payload (Gafgyt)", "value": "c71102ec9295a9875f36e03c0ae4b03b2629d79b11ca7d9e0635d78fd6fc005c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755106, "uuid": "092df998-301f-4b96-875b-3c6d5eb7cab2", "comment": "Malware payload (Gafgyt)", "value": "6ad9db141f7b7fe7964e6979ddd4900047e9e83b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755106, "uuid": "2f5e82bb-f07a-4aa4-a03b-7b59cead0154", "comment": "Malware payload (Gafgyt)", "value": "d525620671d9380dcf849001e96ff03e11e0bf7b4ac0f5a39b8d6595b998325cc802716b1eb93727138fe888c8b4df69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755106, "uuid": "ee8e54a8-dded-451d-85da-37a9b3257d21", "value": "T16103E1B864011AD6D09D40F857B1CB092F26CFD6E506CDCA856EBAC7EE0A5E837D3D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755106, "uuid": "196d9605-04ab-48bf-9342-42cfecbd5042", "value": "768:2uKTbuHn+6SmALL79HYkoQJ6WpInOoMzgV3JgGlzDpbuR1J2MoXsh+ZP:/8buH+lmALLJNB6WpOOXUDVJuZzh+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650755106, "uuid": "edaaccff-b474-49be-9b91-0498118a1d7f", "value": 38632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650755106, "uuid": "33c08054-97be-4732-9f38-333069b1e18f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755106, "uuid": "79d02cc3-6916-4a1f-83e1-b9c32214d023", "value": "540d241293edeabcb4b18825731b24b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dd16da-c2c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650692678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692678, "uuid": "120fe67f-0542-42a1-bf45-c37955d78adf", "comment": "Malware payload (SnakeKeylogger)", "value": "4f46851cdfff179991db543dc95d87fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692678, "uuid": "09427302-a929-4c45-a36a-ddf88c18c9fe", "comment": "Malware payload (SnakeKeylogger)", "value": "c77d21c9baafd0ea0a3135eb10d7e8e860e589413edd56756b1143147d13e029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692678, "uuid": "9ef0dddf-62ab-4efb-a0fb-841e819b1427", "comment": "Malware payload (SnakeKeylogger)", "value": "8b0c98fa7841b96c7caae9f98a73265e4e79fe30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650692678, "uuid": "f5ae0289-f25b-4d77-9e7d-1d806277a93d", "comment": "Malware payload (SnakeKeylogger)", "value": "010dffa41f951f47ec54cd5340c2b5fca4936a99f7d20f5cdd9cc74713344a7d5367d4becd35152d08892244f93c3049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692678, "uuid": "3ed046b7-50b0-4760-a7da-f5ac6725da75", "value": "T1B4A4120176E49B12E7BCD7F96CA1155683F2E136721AE70C4CBAE0FB25613900B5AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692678, "uuid": "49233d10-c522-47d3-bb4f-1c3b095c58c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692678, "uuid": "9f858d60-5c76-41b5-821e-a032879603e6", "value": "12288:8xAYtv/h/2lf5/WVh5g24KqPAZRC1mhLsNpwHR+IewsRh:4BdhuKC24K6Kw3vwx+fwsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650692678, "uuid": "367ff833-b0ea-429b-9b9a-8e9494510f93", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650692678, "uuid": "2f47be69-0827-4778-bbdf-8907745bb912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650692678, "uuid": "b483f3d2-66c6-47d2-9f69-2234728fff07", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f16096e-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650674599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674599, "uuid": "4a1d8aee-695d-434b-b981-e90c85f149a3", "comment": "Malware payload (Heodo)", "value": "fb075cdbff3d7cfc501b4249ceaf3a14", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674599, "uuid": "6c666fd2-1333-4032-8a75-540b1d902898", "comment": "Malware payload (Heodo)", "value": "c8491a6c1c447b7254d7a980209de3251e97ef22439bb6f473ad37b57e659e8f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674599, "uuid": "5ca7e283-99f0-4535-b8b2-a79c86777033", "comment": "Malware payload (Heodo)", "value": "ddaab6a69b394d5e0e600a801b4c311a2037aeb7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674599, "uuid": "6ed8a8d9-7daf-4142-a578-e234e682e10d", "comment": "Malware payload (Heodo)", "value": "b4c59443501959b1b439e81f53f9fd83b5de34e5a62ebd6a73e1651e9781fb14e82626a3dc2997fc32272d43a7f00086", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674599, "uuid": "e492bde5-76b1-4008-8b7e-cc395601557d", "value": "T1EFD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674599, "uuid": "4962a77b-e81d-4453-9ad6-5c4152566d50", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674599, "uuid": "6cbe747d-c3a7-4d62-971e-66eb93d442c5", "value": "12288:C1FIcocJwMTHzXO7N2cBHiyzskF1CubVnmn:tco9MTHzXO7Nt/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674599, "uuid": "53aeddd9-0d27-4613-9ce4-59cb787fcbed", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674599, "uuid": "15397882-5ce6-47cf-97b7-5b3e967573d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674599, "uuid": "615edf24-71ce-4d1d-84f3-9ca427752ea1", "value": "fb075cdbff3d7cfc501b4249ceaf3a14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cc8302-c349-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650747999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650747999, "uuid": "a271f4ca-e854-4e26-af05-81afc3b21c85", "comment": "Malware payload (Heodo)", "value": "5372b11d40593e38f2102185fcc4c658", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650747999, "uuid": "df0e2666-76f7-4e15-91f3-5cca91fd6598", "comment": "Malware payload (Heodo)", "value": "c936ba4d48cc7be323d4c0d2866440f75da152dee0ec2d2ad19f79169deaf28a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650747999, "uuid": "a77e7e41-469d-4153-bef2-b3609c6fa0bb", "comment": "Malware payload (Heodo)", "value": "dd179bf34ed4f6fe793013c13e4b5caeb866d61d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650747999, "uuid": "9ebb4f6c-e665-46e2-9c3f-29ed155894fe", "comment": "Malware payload (Heodo)", "value": "800852f29c8fc1d7357f201911e641128551d36313168ef7b68f1a310a89064cc5ea4924beaa3bcb314bc1bd526d5a45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650747999, "uuid": "50d15e25-393a-4bf8-9c91-7eb8422f2bec", "value": "T176E427137CC34030C89F0875891AF20A6995EF04DB99B33AEBB5BE8D65355979D38B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650747999, "uuid": "a184b250-9a21-485f-a9f4-957404f5bd72", "value": "b39d2fd2d18c2cfe493a1e089561b46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650747999, "uuid": "5ba5aec0-2b9d-44a9-8a3f-dade797fc797", "value": "6144:EiH1vXSjOsl8UG2fde2VwS7D8dwDFYAcAf6UBUfNKLgM1xIhg3teXE3XsuTWKi7T:X14GEdtVlnqYF0ArBUQgM1xou/iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650747999, "uuid": "0fb2bd4f-6888-4379-83bf-05c232faed06", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650747999, "uuid": "b4caac18-f887-4f23-a6b0-01100a51292b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650747999, "uuid": "63116924-2388-4acf-89f3-2c72df29eb00", "value": "emotet_exe_e5_c936ba4d48cc7be323d4c0d2866440f75da152dee0ec2d2ad19f79169deaf28a_2022-04-23__210632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605921fb-c2b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650682762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682762, "uuid": "f767d6c6-6ff8-47c2-ae30-e54189b8f0f2", "comment": "Malware payload (Heodo)", "value": "6a4f83fa1b59b3c8a1ebe4d61e04a387", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682762, "uuid": "119da26d-2ac6-4d83-906c-10191f1a6333", "comment": "Malware payload (Heodo)", "value": "ca53eadc044c9e9f900593cfe06511d6c94f6363b54b29959360f09732dfa87c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682762, "uuid": "80c7a613-b885-44b8-8d1e-7e6e3011d85c", "comment": "Malware payload (Heodo)", "value": "73db617a3e3f5ea7d9b54269805d85b332448612", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682762, "uuid": "bfbeb634-6e99-4826-85c0-5195b8f0ab26", "comment": "Malware payload (Heodo)", "value": "2ac30992128b4e51ba0bc36bbe81729110d04c4a6ac437fd020f8058436f318d643bc61038c1177fdb14a5f247226c4f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682762, "uuid": "34c3b285-494f-4110-abb5-33e1c845f42c", "value": "T130D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682762, "uuid": "31475a31-b7c1-473e-97bc-586bf1a74d09", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682762, "uuid": "fe1d5cae-8c3a-46c9-9326-254950b58113", "value": "12288:C1FIcocJwMTHzXO7N2aBHiyzskF1CubVnmn:tco9MTHzXO7NX/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650682762, "uuid": "ca51b64b-7d59-402e-956d-10408552c742", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650682762, "uuid": "51ea6c65-0cde-4ecb-908d-5d34525b4b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682762, "uuid": "fa42d107-9a82-4a55-bdbf-b2461ba9c81e", "value": "6a4f83fa1b59b3c8a1ebe4d61e04a387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3e6136-c2d6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650698517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650698517, "uuid": "31d71f9e-fa88-49df-be40-023fbd2608c2", "comment": "Malware payload (RedLineStealer)", "value": "bbcbd68b61b682d853c141f8b55c7bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650698517, "uuid": "284a677c-009d-456c-8bb6-cec82f296397", "comment": "Malware payload (RedLineStealer)", "value": "ca7def22f92a2b68a95800b01e76b5f807b7fcdb28a9a15a5e63a93e5c5a61e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650698517, "uuid": "f0356de2-bc37-4cff-9b86-43f95a54e89d", "comment": "Malware payload (RedLineStealer)", "value": "f4b9f4efc8c988e92aef1fb4a112240d8d72f70d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650698517, "uuid": "d52c2be8-4240-45b6-9e52-1dd11ee54e87", "comment": "Malware payload (RedLineStealer)", "value": "6ebd93e46ee8d3e2a48c13add728925a99f554ca85dc8b3a41ad8492494cafa16b23b6b07cae263d139c635d6871b1fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650698517, "uuid": "dbebe2d2-c120-4fb1-b38a-669363148983", "value": "T1B9851250B351CC67F06B8475446E957012F29B68A0E8D28D788BB31E2AF239550FFE9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650698517, "uuid": "f07f9b7e-0ace-4c59-84d9-43972a11365b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650698517, "uuid": "6ad6f4df-33af-41a6-8932-bfa3018460e0", "value": "49152:FNtsIILeQSBtNtsIILeQSBcNbSzDQiajsrMA/monqGp:LtSeQQtSeQNGz0iajsAJoq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650698517, "uuid": "18e266f4-975d-4f3a-aae9-815128dacca2", "value": 1736704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650698517, "uuid": "9a2614e5-087c-4329-81ca-36509a9b923b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650698517, "uuid": "45e89bd1-f799-4b8e-9e07-3ddf9f0de415", "value": "bbcbd68b61b682d853c141f8b55c7bda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fd1ccf-c30e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650722906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722906, "uuid": "2f7e08ef-ffb0-47ad-915f-1b1ac79b2924", "comment": "Malware payload (Heodo)", "value": "c7af30c150f54636522e8bb3d8e7147b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722906, "uuid": "182a722c-6018-4d34-bc4c-f3a4d867c2ba", "comment": "Malware payload (Heodo)", "value": "cbf40fc2cf5c44ac5c166c6acfccf3415037fd85a71fece6b62ffd81780f2c8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722906, "uuid": "276d3240-b16a-4c5d-ae8b-0a23348fa8de", "comment": "Malware payload (Heodo)", "value": "f29e67f4726760ae8aaf213107e68040efd9d51d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650722906, "uuid": "810a083b-b66e-42c5-8e9f-d1eff902be01", "comment": "Malware payload (Heodo)", "value": "203f372bd58b3e96c59f79397dac62be6f875b88dfbb9a6a59eba6f1768efd3597b8c1feafff34089868a22ac22a1f80", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722906, "uuid": "4b004fdc-fcc6-4a06-99a4-8f1b60d50996", "value": "T12394AE41F692C07BC5AA15302A955B7AABF8ED500FA1EDC3A7E1CE1D5C335C26A3A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722906, "uuid": "bf0a9761-1485-481a-a21c-ff2a7723ee0c", "value": "8e981acbea246d911834e505c8276a50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722906, "uuid": "d0c592cb-6b53-4382-aebe-a33f1e44ea55", "value": "6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQPJuSReK/0D0kGsoan2:C0AGj17ZWi4QWzdDIso9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650722906, "uuid": "dda96148-7dc9-426e-b8da-eead2279506f", "value": 435264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650722906, "uuid": "48b7963b-b6dd-485c-88bf-af9402633479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650722906, "uuid": "c05497c6-fd43-4e75-b766-80a08b355df1", "value": "emotet_exe_e5_cbf40fc2cf5c44ac5c166c6acfccf3415037fd85a71fece6b62ffd81780f2c8f_2022-04-23__140821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07154eb-c2ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650680776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680776, "uuid": "c0b6160d-a932-4a52-b9e2-9c810fd422cf", "comment": "Malware payload (Mirai)", "value": "91bca29a1b0cb79aa289a36caa219d72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680776, "uuid": "8ec862ad-8226-49ea-9a12-3340e3e40404", "comment": "Malware payload (Mirai)", "value": "cc9c73c8f23f0c657f777b898971df944b7f2832d8107368ad76215cc763792c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680776, "uuid": "8ec36f00-5144-4fa3-b72a-4e0c66e86765", "comment": "Malware payload (Mirai)", "value": "e54fbf3415ab1320e33ca5ee7b187be96a672156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650680776, "uuid": "56074d71-a1e2-4d7a-8bf7-bcfd3cc15ab0", "comment": "Malware payload (Mirai)", "value": "0d8fe5a463386f1217f4cbb2c4c0f2e2710e05686835d88724a2eaf02c3346003c907b8c450fff8b8a7fb10b18302696", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680776, "uuid": "64b151c5-d5a9-4c5b-a938-0ba1842375e1", "value": "T18EB2C065C63A88709BB20930CC7FC555B7A79AFCD0C3B313296A20B05527A0568B6FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680776, "uuid": "3e231dcb-159c-4803-bbea-925b63c1fc27", "value": "384:QUfbkSogPjZCU7/iDdtzOwuf3OxRMCxpSk+J2m0knejbqhymdGUop5hKgy:DQSok8UbcOwG3O1Pxm2Hknenqs3UozYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650680776, "uuid": "cde93c07-4fd0-458c-8e95-3e626f85c5a8", "value": 23748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650680776, "uuid": "ea484c3b-079a-4f1a-a163-7d1237e79e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650680776, "uuid": "108434ee-6e7c-4094-b3ed-e23df373b27f", "value": "91bca29a1b0cb79aa289a36caa219d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9237eb9-c353-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650752462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752462, "uuid": "e1b15175-9fa6-4eda-a3b8-bbf72b21e1ce", "comment": "Malware payload", "value": "94629af828adec1691eae7974a332ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752462, "uuid": "f60462aa-40c5-4672-b9ed-e4f54e128c9c", "comment": "Malware payload", "value": "ccf19eeb3f62c028896bfb27951aa50ade9f8100015c96f28f63c8559b143124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752462, "uuid": "459364ec-c39f-4e88-a99c-6690b3386017", "comment": "Malware payload", "value": "73e0dd2dabc1cf5528409c7a500d46a89c077d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752462, "uuid": "ec591401-eaac-4f14-b1c5-e05579c26f7e", "comment": "Malware payload", "value": "c1a728d95297929d3b64ec79630aabe1f55f079ed0209ce259ec2932f9376c130b1a2ca96b7d28e0ace2d46526f10dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752462, "uuid": "cee63eeb-ee84-44a0-8267-2cbe33ed8823", "value": "T1307723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752462, "uuid": "4324d585-6606-47c3-93b7-40e0fca20dde", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752462, "uuid": "604fdb38-86e1-4d38-a8cc-35a4e6dc29d3", "value": "393216:9ADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8Z:9AwwU8SAwwU8SAwwU8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650752462, "uuid": "e8e9cb0e-1205-45fa-903b-09b320b26890", "value": 35782076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650752462, "uuid": "3385a7e4-9714-4279-94a2-1b5fbbb4bb57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752462, "uuid": "937edc1d-2c2b-4b58-b2b3-789888ec06e4", "value": "windows11-setup_11_7798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f4a9b0-c2cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650695762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695762, "uuid": "7e70a8ee-dd56-4711-8912-30ccf50df795", "comment": "Malware payload (DCRat)", "value": "ba25a9a4adce44259dca4e6311ecc392", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695762, "uuid": "4aa278c7-d265-4513-9c26-654251291c0f", "comment": "Malware payload (DCRat)", "value": "cfae61bf8bc9dc0fec9b0765377bc8312d79710adca08e5de4f36a4a7d21b1a2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695762, "uuid": "523c979b-dd1a-4426-824f-980ff5bd9193", "comment": "Malware payload (DCRat)", "value": "e925100ea8a8f0cf4b5444d6200a16c39d680e26", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695762, "uuid": "6cf2df4d-cbc9-43b3-a4a3-7b015edc689e", "comment": "Malware payload (DCRat)", "value": "16861a4a2b83501c011c8b8c506c5743180b28b76a57fecce9ff9335179e59cc5b2fb751fc23a0992cf0e02233a49d1e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695762, "uuid": "0380f7c0-fe0d-4f04-8168-b3fee491211f", "value": "T17A658C027F40DB12E0A45237C2EFDA5843A0ED456AA6E31F7DAA336D15017A77C8D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695762, "uuid": "cc9310db-238e-4fe7-80fe-c0e8ab23c5c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695762, "uuid": "41ee43a9-24ea-41b8-af2a-75167ce6f8a4", "value": "24576:UlmyJ5FqJipBpreVaMkk6wjjvhHP0cXM3BVc7cDsue:1yfxp696wfecOVcAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650695762, "uuid": "f390c6ab-31b3-40a4-b7cf-8ec32a28ced2", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650695762, "uuid": "461fbeac-33af-4ade-a127-fe32af916f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695762, "uuid": "438c78bd-d092-4014-aca9-3e4d142ed1de", "value": "ba25a9a4adce44259dca4e6311ecc392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce5a7aa-c356-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650753677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753677, "uuid": "899fcb80-230b-4839-a16f-2f02c0629828", "comment": "Malware payload", "value": "5bf59a9b163cb7968f1b60bc1bd40a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753677, "uuid": "9c47094f-488b-41b8-bbae-c14d8610367b", "comment": "Malware payload", "value": "d0b191dd9931c245af0c8156a00233617de9d24e5018f8f5e7af8c54eb4c728a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753677, "uuid": "64e3ff0a-2412-49a8-999a-b727360de76c", "comment": "Malware payload", "value": "28d6b467663f5bc6ece520cf358be1726c0ae218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753677, "uuid": "c2e603ea-3dc5-4787-b4cf-da4a1f5ab3bb", "comment": "Malware payload", "value": "10e33ec9b09cecf31fa6196139186ca7eda999f74c835b6fe9085258dcafe8182bc806b75fc101cf8526993b92f8d6c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753677, "uuid": "d2de7f38-f2b3-4cb9-b65a-8ffafbc165c3", "value": "T1727723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753677, "uuid": "0aefdd85-415e-469e-9b1f-68ec0025a49b", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753677, "uuid": "97693a9c-91e6-4c09-ae7e-b76211f3364a", "value": "393216:9ADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8K:9AwwU8SAwwU8SAwwU8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753677, "uuid": "6e19beac-46a7-49c5-9a35-7de80073532d", "value": 35782076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753677, "uuid": "48d2447b-26d2-4c35-893b-947d09857eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753677, "uuid": "042bccd7-fddb-423f-a637-931e2ca86e72", "value": "windows11-setup_11_13336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a70e8a-c2bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (SystemBC)", "timestamp": 1650687983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650687983, "uuid": "646d5800-0e82-4210-be67-9060257c41a2", "comment": "Malware payload (SystemBC)", "value": "546a938a34280d863ba416c0aacdb04e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650687983, "uuid": "0dc69b69-0bb6-44a3-87ac-37b22a53ebcf", "comment": "Malware payload (SystemBC)", "value": "d0f3211e3a351e4f7384243f983a33a0b4e989b61fea1e1c098bb5c8241ae102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650687983, "uuid": "2e906eac-36df-4978-bb5e-0fd636a1d306", "comment": "Malware payload (SystemBC)", "value": "824f329cb115c4411d9651b029571f4759ac842e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650687983, "uuid": "1bab8d0e-0d27-4af4-acf8-4372e6e2e9b4", "comment": "Malware payload (SystemBC)", "value": "fd0038073bddb33c2e0382cc6886f478fc48fa3bebb08cb8dfb2c1468c4f2abc8d11c9bbee3e61e5ab4131c814e01f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650687983, "uuid": "ecb87b7b-5a46-4ae9-85eb-8f266029d8c6", "value": "T1C9349E21F3A08031D1A75D3C64A1DFB1196FB8325A70D50BE7A46B6E2EF03C15AB5367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650687983, "uuid": "989cf510-a7e5-4b1d-86e9-ea7de477abbc", "value": "e2fde10f23cc64779d6592c0a5cf9862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650687983, "uuid": "a55febf8-f24c-4192-a7b0-5c2e0ba17850", "value": "3072:0GZ1YVMWpXm7aHKq0znbUP4hh3nT+kI60KFsxkgaBChpE:b2M6XmuFabe8VdGKaiga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650687983, "uuid": "16448272-4e22-4c1c-a4c7-923fdf695491", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650687983, "uuid": "16e4e6d2-fb63-4a69-a631-d7ed88597a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650687983, "uuid": "31a1c659-16a6-4c0c-8bd1-08752aee7a62", "value": "546a938a34280d863ba416c0aacdb04e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2472130c-c30b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650721316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650721316, "uuid": "60ae3939-d520-43fc-8ed2-bf8c8333e05b", "comment": "Malware payload (Heodo)", "value": "f0b2a79dd654120791d5f97d09470b83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650721316, "uuid": "fd767941-8b4f-480b-b140-4168ed2b3a76", "comment": "Malware payload (Heodo)", "value": "d203595f6144dc6ff149a6e27c53052433b4ca1d6fff0cd05c2dabf7539ab703", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650721316, "uuid": "5469b886-76da-4c36-adf7-23587ad149f0", "comment": "Malware payload (Heodo)", "value": "000627c582ffbc2c89314a4dd22d0232b8f86a58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650721316, "uuid": "b6257ae8-b096-4320-b6bd-94945294b8ec", "comment": "Malware payload (Heodo)", "value": "a5557edd69f3b5ee59ee95d2ece96af184a2dff9d8c9ef2f730cf1062afdbe19b7a82cea69c664c726bfadaa9576208a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650721316, "uuid": "5d2b3ced-801e-4cc6-8ed0-440bd0ceb875", "value": "T17264DF127291C0B6D79F03344E878B7E77F4A9418F61DBC36B94DF2D1E32242B926269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650721316, "uuid": "e56750d3-f6a0-4a09-8d58-e0a73a4d9ecf", "value": "f9052a428f025680924ffe4c32374e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650721316, "uuid": "6d2c064c-a7ab-4849-9c82-ca51a1c77ceb", "value": "6144:wcvynX8aBmTd9m6qH4YCdPvogjav1iP/I4yi:/vynLkTbmgog7Hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650721316, "uuid": "9e17f9d2-d0f4-4a30-a206-f0223dafa874", "value": 311978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650721316, "uuid": "6c3c23e1-b8d7-42fc-b4b8-8f510f67eb88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650721316, "uuid": "5d061d49-9bbd-4e35-84e3-9893500e95d1", "value": "emotet_exe_e4_d203595f6144dc6ff149a6e27c53052433b4ca1d6fff0cd05c2dabf7539ab703_2022-04-23__134150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aafeb31-c2f4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650711636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650711636, "uuid": "c00d7b95-7da4-45f5-bdc8-6006fa841964", "comment": "Malware payload", "value": "f6065f381e166decd4772c0e1eda4173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650711636, "uuid": "ee5a3986-3f08-41d2-9dfc-4216b2e6044e", "comment": "Malware payload", "value": "d2205532e27cf8ae9dbc0a62fdf3fca598f5fa8f9cc948bec49df54b0b8a8cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650711636, "uuid": "27fda67f-0b84-4c36-9a5c-afc8a923ddd8", "comment": "Malware payload", "value": "18aa4c449cd470a9ec47f560ccad9e47cd62bb59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650711636, "uuid": "02ce24eb-2143-4d18-9478-7098ba09413f", "comment": "Malware payload", "value": "ed715ae84862231540825b64340621d094fb23a6e57e7ae71257846ee08114476a8dbf97d92d4aa273bdd59d60a73453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650711636, "uuid": "47832286-731d-4269-877f-a2373e44f74a", "value": "T12C8723EBB228613ED56E06324473A67C483B7A2CA7DB8C1A47F30D0DDF1656D1E3A905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650711636, "uuid": "b18c521b-7aeb-4549-9766-3d944cac01c2", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650711636, "uuid": "29d862c6-89a1-47e2-b5cc-28e040838e10", "value": "786432:BRCNzTy9c5tWCYxRfs8cRCNzTy9c5tWCYxRfs8cRCNzTy9c5tWCYxRfs8+:6wqOfv5wqOfv5wqOfv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650711636, "uuid": "27403e1a-2980-4340-a8f9-5722bdf4e594", "value": 36016388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650711636, "uuid": "f874c550-6b21-4040-84a3-d334aa85a4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650711636, "uuid": "c1b8c188-4790-47ab-b1c3-a54a1ba9a832", "value": "windows11-setup_11_24468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6712b5-c2d1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650696685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696685, "uuid": "56b34f7c-0f8c-4f38-898b-80c72b5e2124", "comment": "Malware payload", "value": "6113873b074c6eedaa6e7881ee766990", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696685, "uuid": "8b96d96f-bcaa-4b8a-83bd-35529f15f39e", "comment": "Malware payload", "value": "d537cc0e2818a5bd240973438d0cdfd777519aa06da41a228dc378b233aaddee", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696685, "uuid": "70503db8-5cf2-4731-9612-4d8bddafad39", "comment": "Malware payload", "value": "d7731b3276a2a213758b441c2e48a8123001c73f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650696685, "uuid": "9a3199e6-ec46-4526-9adc-1ef5f5bf1c74", "comment": "Malware payload", "value": "69d47d4ccbfcc17777c5a6cdd9864825021b8c4f1f68a6a3f50e4ed6feab452c099cdb8297de33d882febdab57ea7bda", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696685, "uuid": "5e79d29b-0ebf-4be7-b21f-80630e433bfc", "value": "T15D116BC7498782E98F113AF9F1553417A1339083D86C1C41A5D703D28C9A04AC3FABEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696685, "uuid": "cc29c259-1d1d-4c61-96a1-8b7b4a99b5ff", "value": "12:4rknf8TEf29+9nz32vOx9nEXxORHD7HqPTEf29+9naGQ65zan6H6Qu6MN/bnGNrS:bqODVH/HqiIGZAN/qNrGihE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650696685, "uuid": "b6069a5b-b9f2-410a-8f7d-c8b913841648", "value": 868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650696685, "uuid": "63c3d43c-231b-4463-bb38-91dff9173d04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650696685, "uuid": "bcd987df-8e93-4c94-9a53-160b2d1c5e95", "value": "nc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8d1038-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZLoader)", "timestamp": 1650734352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734352, "uuid": "308eb214-f1e5-45d5-b65a-7fb24bcb80c7", "comment": "Malware payload (ZLoader)", "value": "12287f5f4e8f9655ed01a5ccafe689c8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734352, "uuid": "5c1a4b8b-8e20-4917-96ae-a9834cbe4f26", "comment": "Malware payload (ZLoader)", "value": "d553238215e2eee33893735019dfe83d658ba5885150aeb5ec5d3739012c645d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734352, "uuid": "03e4251a-029f-4484-abe7-675bf9f3fac9", "comment": "Malware payload (ZLoader)", "value": "f8eb6c1f9f99ee877f652aec5ecec652a8e839fb", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734352, "uuid": "498a90db-2eec-4dfc-a7a1-5b734ff85347", "comment": "Malware payload (ZLoader)", "value": "188395abab4314241cd82704f36ff3d29f01af6d4aa017f53abd5b521a46d59e69d6b490f4ed50971b2a334c3cc69f66", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734352, "uuid": "38b15dae-9776-40a8-a01d-398d3de1736a", "value": "T117F251E3BB85ED65CE58837548AB43A0A703EC51576B838B3355F6393FB1BE04902547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734352, "uuid": "a648ad8e-1fd5-4ca1-bf36-4a3f11f9338b", "value": "768:JPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsUtaoSLSt8er05TZ:Bok3hbdlylKsgqopeJBWhZFGkE+cL2NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734352, "uuid": "a4d67712-5d07-46f9-8390-ef3ae6272ee9", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734352, "uuid": "b5dc04a7-22e6-41b9-bc9d-3f6e372c2dda", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734352, "uuid": "989a2738-29e4-407b-861a-0d4021c68a67", "value": "new.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874e46d1-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZLoader)", "timestamp": 1650734367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734367, "uuid": "7721db3c-3422-4525-aed0-f7e24d9241c0", "comment": "Malware payload (ZLoader)", "value": "87085753ac1e1b374844a3dddf59e59c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734367, "uuid": "cc4457a6-fb0a-4a88-ab9e-bf87ac439294", "comment": "Malware payload (ZLoader)", "value": "d556b7e0820a135edcd80ca58d4854a46c5f0d309f26d2d4d8c5b5a8686c6286", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734367, "uuid": "8a754bc0-91b7-49b3-bbd8-9fcfcf62006e", "comment": "Malware payload (ZLoader)", "value": "bf87256d0aa454fca66a6995c4a0a95b799a2d92", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734367, "uuid": "0d6b085b-dbfc-4a12-961c-2f036b147704", "comment": "Malware payload (ZLoader)", "value": "22b08ce6583b71686ffab7ab09df778e7db1158386e363e96e030c5ec5ac86c566340fe2a8907428ee5438815c8fb48a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734367, "uuid": "cacd89b2-2fba-460e-adf0-0c7616f60b90", "value": "T12DF285F7B796ED25CE584376086B42A06303EC515BAB838B3355F72A3F71BE05A02587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734367, "uuid": "4f5d266f-890e-491f-b314-359b6dfc051b", "value": "768:xPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJy3bCg/VbSJiqkK/2zji:5ok3hbdlylKsgqopeJBWhZFGkE+cL2No", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734367, "uuid": "8074b40a-1891-4268-8262-94fe76823592", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734367, "uuid": "17f750ca-4604-4fe9-be60-7b85d177f686", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734367, "uuid": "baa1da4e-1000-4aba-8f72-509526280118", "value": "sheet.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83196f8b-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZLoader)", "timestamp": 1650734360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734360, "uuid": "1edd0b9a-2b2c-4c22-bc38-f2fc5acc20bc", "comment": "Malware payload (ZLoader)", "value": "a3c5dbb91db79048051b10c1164912c7", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734360, "uuid": "67a81828-79e1-4d41-9230-99e153df95c0", "comment": "Malware payload (ZLoader)", "value": "d55ac109967ad7ba845f8355192ef69a8ffd5a0e1038fbb94e75f974ca569246", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734360, "uuid": "de4c00ae-bddb-4ffc-8016-515c019fdef4", "comment": "Malware payload (ZLoader)", "value": "6b589814ac3f42e105bdbacfa5a737856c9a2d12", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734360, "uuid": "23d3cdcb-510f-496e-b8e5-5f67bff9b4de", "comment": "Malware payload (ZLoader)", "value": "6f1ee4234bcbc55054bced3482e32d7d24db538c568d0aef8f546aaff851c4c282425f4eb806519ee539fa51e721d540", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734360, "uuid": "6f7d327a-b583-4418-b377-bfc836832993", "value": "T133F263E3BB95EE65CE088375486B4391A713EC525B6B83873358F7293FB1BE04902587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734360, "uuid": "9d5001f4-62a6-49fb-9590-3ccd8bf3a5ca", "value": "768:dPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJhbveuw1TJPjFu/ib+ZD:Vok3hbdlylKsgqopeJBWhZFGkE+cL2Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734360, "uuid": "c3553e6c-72a5-420f-b38a-5864e85a7380", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734360, "uuid": "c695330d-6902-48f4-9527-31ba53688e8f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734360, "uuid": "9456eed9-8f2b-423b-9620-8bf2c178e812", "value": "report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3ebc81-c329-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZLoader)", "timestamp": 1650734506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734506, "uuid": "8b1ec8b6-4a6f-43eb-9d64-78ef35e02c9f", "comment": "Malware payload (ZLoader)", "value": "fafae91a23f2c375f613b5dd1ed7dbc9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734506, "uuid": "2d7a70bc-8f73-4389-a475-650985f56462", "comment": "Malware payload (ZLoader)", "value": "d55b219cab698a036e8043e2652923f7b9831ad543d486038e92cc1faf56c0d4", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734506, "uuid": "a4c39c87-56f9-4272-8826-25fa045d4351", "comment": "Malware payload (ZLoader)", "value": "f4701547a36a92965353c8c6ac16d28a798841df", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650734506, "uuid": "17963da3-5942-4dd2-80a9-a9e73de32aee", "comment": "Malware payload (ZLoader)", "value": "0b4da77f53d6043214cc6f163c71a43cbf6a85fca8780c5388394369c1e695f4fdd39171143d87514cfcd68e1fb9eae8", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734506, "uuid": "963cdb9e-53ce-4e15-abd1-455d01a736c5", "value": "T154F264F7ABD69C65CE488376486B42906713EC5157AB838B3344F7263FB1BE05E02687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734506, "uuid": "d52e66b9-a9b9-4084-afbe-d071cf8a2f97", "value": "768:cPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJNAOSORpMZ4R0X2:Iok3hbdlylKsgqopeJBWhZFGkE+cL2NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650734506, "uuid": "b3d05fea-25e8-4fdb-840e-233b13488333", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650734506, "uuid": "3bb0d873-76a4-4360-973f-e9f5a1caf142", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650734506, "uuid": "6fd1eff7-bb8b-4642-b77f-6245486046d5", "value": "invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bae59f-c2ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650709559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650709559, "uuid": "4e5f96b6-a5ed-475f-9eba-d207a0b77988", "comment": "Malware payload (DCRat)", "value": "c15af2a4c03631a3351e5f2dde5005b9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650709559, "uuid": "cf2dcfab-5a01-4136-ae91-89c86fe5f3af", "comment": "Malware payload (DCRat)", "value": "d9df7c3907c65ebb3aa556e47f8eac64e16d3415c9a8695cd7ea754b1612055b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650709559, "uuid": "ac956960-ef0f-4fa7-a4f6-af0e502aed1c", "comment": "Malware payload (DCRat)", "value": "261167c9c6856148f2adddb0a4c003e75580c6bb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650709559, "uuid": "1cc8d6f7-1c53-49ca-9217-87ff14438a42", "comment": "Malware payload (DCRat)", "value": "d218cf3a1705b068fbc8ac35dc2dac232450e597c3471313fd260d78f7dd7b76ce1b73182cdd96b2fe4132f957e76c85", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650709559, "uuid": "d026eaed-139b-4ddf-8621-192ea2ebc3bf", "value": "T1F6658C027F40DB12E0A45237C2EFDA5843A0ED456AA6E31F7DAA336D15017A77C8D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650709559, "uuid": "8a87b4c4-18cb-4b92-a8c3-42844063039a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650709559, "uuid": "bf5c0876-6978-4953-b28a-4501d6e2ac5c", "value": "24576:0lmyJ5FqJipBpreVaMkk6wjjvhHP0cXM3BVc7cDsue:Vyfxp696wfecOVcAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650709559, "uuid": "88a29138-d491-45bc-9813-3f3545586207", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650709559, "uuid": "f82d0fde-105f-4d01-b34e-9de6cef544ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650709559, "uuid": "7baccf1c-4938-43b2-a53b-697ca8fd6b90", "value": "c15af2a4c03631a3351e5f2dde5005b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3033d3-c2ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650708288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708288, "uuid": "f992dc38-425d-4e01-938d-cda7de194ada", "comment": "Malware payload (RedLineStealer)", "value": "21c2f707a365d4cf2760b03ffb5296a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708288, "uuid": "baa5560b-9f84-4672-b182-0974e81f5e74", "comment": "Malware payload (RedLineStealer)", "value": "da157ca6f018f8abe19d11c21a86840f7561677afb06bc19ac6b4158ad49f7bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708288, "uuid": "994ad7f8-5922-4150-91bf-c358cbdbdf65", "comment": "Malware payload (RedLineStealer)", "value": "2efa1c75e8df43ce6630cf745f40797542b95e67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650708288, "uuid": "e81e3107-317f-49ea-9b33-48dc107bd9c1", "comment": "Malware payload (RedLineStealer)", "value": "6ac07b715197f19da375292446cc861cb33b21af0b3fb555330bf6c9b0ddfff248d623129399e50bc5c56056a94c2157", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708288, "uuid": "36f913ee-20fa-429c-a9cf-68edaf0eccde", "value": "T11864011076B0C432DDA21B7C0C64C2A24D6E7D51EBB8D85F778417AAEDB06C276B47A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708288, "uuid": "02126774-a8fa-45aa-bddd-145ba5083a49", "value": "b7552d5effe5c4c3a2172befeeff5e31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708288, "uuid": "113e29bd-a866-4276-bdaa-b73d730ec747", "value": "6144:iN0UZBxsoEJjegX6V1/8cE7yUEoXYz6FJmo/V+ZfJkwHNwiO:iN0UZBxsPKgqV10cE7Fozkk9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650708288, "uuid": "6251d5b8-f47d-48b0-99e9-0c5cf07d7bad", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650708288, "uuid": "aa7cd4df-5df5-4a58-8662-2ce424e5a84e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650708288, "uuid": "d78d3165-d2b4-446d-8551-84aafdf3b275", "value": "21c2f707a365d4cf2760b03ffb5296a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c834a0-c2cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650693807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693807, "uuid": "77ddcc2b-26ac-456a-a550-50ee1842cc64", "comment": "Malware payload (Formbook)", "value": "62f1e7d6863eb40c9820f93675a0da6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693807, "uuid": "4de07018-7a3f-433c-b2a3-160284bd0128", "comment": "Malware payload (Formbook)", "value": "da1d51ff02a28f6680d28b2e3e69d75912fdecb650a657b46d1f16aecee81c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693807, "uuid": "9987563f-5a09-400d-a888-af4bee077394", "comment": "Malware payload (Formbook)", "value": "d0065d7f0b9749c04f40d6f6fd4015000c3477a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693807, "uuid": "55b35f0b-4fee-451c-97ac-211e739d366f", "comment": "Malware payload (Formbook)", "value": "a8e63a4d8bfe1e38425da2fd890cce3dcb3750cef97e8f34efa4ff72652f89f2c2fe2b86fd3f198e8f7d7279f62a0731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693807, "uuid": "6c577680-ed35-4ff0-9d8b-bdc04cabb4de", "value": "T1FD341254FB98D073DCB61A310E3AEE915EAD671205B9560F2310EBCE7E32A411B4E379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693807, "uuid": "1580377e-ad7c-4cae-b6bb-2bd631c6b2ad", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693807, "uuid": "f5195fca-c734-443e-bb4d-40756d8596a0", "value": "6144:HNeZmSTZVxRXbMiSz+KW8Y3be2ZCseP0/7KX:HNlMVPs+pfLJZ/glX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693807, "uuid": "33b19f3e-348f-4bb1-aa04-d651197cf9fe", "value": 246684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693807, "uuid": "48667b14-671b-493f-9d1b-644de5b9f8b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693807, "uuid": "f592df20-6312-4b7c-b12c-4a93917f81e0", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ce9d76-c31f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Checkmail)", "timestamp": 1650729848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650729848, "uuid": "2ebc7f88-89de-4d1b-8b68-5fa82f81e050", "comment": "Malware payload (Checkmail)", "value": "54c24db7a6b6186a5727042d7094c000", "object_relation": "md5", "Tag": [ { "name": "Checkmail", "colour": "#792A21", "exportable": true, "hide_tag": false }, { "name": "CheckMail7", "colour": "#B86037", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650729848, "uuid": "82cd39ef-6068-403d-bcbc-a1a8145bb122", "comment": "Malware payload (Checkmail)", "value": "daccb68f01c806839d025c4d8ffda45357767e1dcc467d29f59cf64159176ab9", "object_relation": "sha256", "Tag": [ { "name": "Checkmail", "colour": "#792A21", "exportable": true, "hide_tag": false }, { "name": "CheckMail7", "colour": "#B86037", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650729848, "uuid": "7354e86e-2e18-43c0-a545-0d20bf35681a", "comment": "Malware payload (Checkmail)", "value": "c5b1d7d7ee1cfedf230dcf2106986afd1ab0eb06", "object_relation": "sha1", "Tag": [ { "name": "Checkmail", "colour": "#792A21", "exportable": true, "hide_tag": false }, { "name": "CheckMail7", "colour": "#B86037", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650729848, "uuid": "5c8f398d-3bbd-46ed-b636-27a250a5ced4", "comment": "Malware payload (Checkmail)", "value": "a2fbac2781abeea401f5ea9f989ae78fbf64adcd13a5260a6ca811204cf9bc916cac20c8b0d48efb4053fc64b72232e3", "object_relation": "sha3-384", "Tag": [ { "name": "Checkmail", "colour": "#792A21", "exportable": true, "hide_tag": false }, { "name": "CheckMail7", "colour": "#B86037", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650729848, "uuid": "eaa8e3be-38d0-4b8a-aa37-189cbb0e4561", "value": "T1BF847D37F6D08433D1632A3CCC5B9BA899297E512E2578867BE82D8C5F397C17426393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650729848, "uuid": "264cba34-213c-4e22-bea0-8067b97ec506", "value": "a444cab8d002a49fcab4b92927691da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650729848, "uuid": "dc557547-2e00-4d25-a108-5e0258528855", "value": "6144:66dDv2EMLrOQ4sqMbh3jGB1ObHotRyEecZK0A+FL7k01IKKNO6bwvulv:dxuEMLrFZxjZotR7fZV60zJ68vEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650729848, "uuid": "ed8063f6-923f-48aa-934e-cbb61f14960f", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650729848, "uuid": "9f4c7843-ebea-4d4e-bd47-e17505024d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650729848, "uuid": "5d8adde6-c06a-4ff8-a9ba-1fec3eaab68c", "value": "2020-01-08 114318.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9084f3ba-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672105, "uuid": "c9bf5960-d1dc-4563-9115-b6f221c9b929", "comment": "Malware payload (Heodo)", "value": "582cab329345f7eb5e2390f13fab649b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672105, "uuid": "0854600c-1a58-47df-b4bb-4a29aeaa9a72", "comment": "Malware payload (Heodo)", "value": "dba9c3236255dd0d9091b2693a43da9102a838490be208798949f249be76af84", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672105, "uuid": "c188e7ec-e637-4c0c-9f83-f3d98af2e425", "comment": "Malware payload (Heodo)", "value": "285977ab46a71f3ef53194c21092f9b7803460ec", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672105, "uuid": "ce14abec-4ca3-4d19-995c-b60b5815f39a", "comment": "Malware payload (Heodo)", "value": "f55bce7ced5f3e36ec83235dd4185dcd080d2455280a119b48269b741f98f5613d17b5649b47865ce91166a9946f2102", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672105, "uuid": "18b94049-2ea0-47d7-90dc-54e1d79b3321", "value": "T1C9D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672105, "uuid": "3f92ea35-7498-4486-9994-dc4503aea3c5", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672105, "uuid": "9e74f44f-9657-4391-a278-f562c1cc3c59", "value": "12288:C1FIcocJwMTHzXO7N2YBHiyzskF1CubVnmn:tco9MTHzXO7N1/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672105, "uuid": "51e9de04-a2a8-44cd-bc44-efffcb56ccdd", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672105, "uuid": "14e10929-339d-4208-8523-830904d9a9a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672105, "uuid": "64155b83-ee00-4c79-8883-d9c08cee24fc", "value": "emotet_exe_e4_dba9c3236255dd0d9091b2693a43da9102a838490be208798949f249be76af84_2022-04-23__000140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff8f6f8-c2d7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650699002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650699002, "uuid": "0cb2d1ae-709c-40b2-8772-23c05243a767", "comment": "Malware payload", "value": "712ef1092e630cec4e8b7fcdbe9441f7", "object_relation": "md5", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "mim", "colour": "#98B907", "exportable": true, "hide_tag": false }, { "name": "PEM", "colour": "#94C7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650699002, "uuid": "fe796439-21f9-4ad2-9ca1-6cc0cd0ba388", "comment": "Malware payload", "value": "dd155b80f1296d1e66de0d19044f55e6cd148eaaf0f06c616a451edaad58c754", "object_relation": "sha256", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "mim", "colour": "#98B907", "exportable": true, "hide_tag": false }, { "name": "PEM", "colour": "#94C7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650699002, "uuid": "fc414b0d-7761-4c04-a433-a4d549ddb804", "comment": "Malware payload", "value": "252c9a68ab7f5d760128767973f3b0ac61955fce", "object_relation": "sha1", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "mim", "colour": "#98B907", "exportable": true, "hide_tag": false }, { "name": "PEM", "colour": "#94C7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650699002, "uuid": "be28fc6e-67c3-4b92-90bd-37e6c23e8d12", "comment": "Malware payload", "value": "7313ed25dcfcf4ee8fdf49624e440ee5213af33acaf8fe6b3ab47f930c9b0f35cb4d67b5b4f22e0b1af72ed8d9b9927f", "object_relation": "sha3-384", "Tag": [ { "name": "CertUtil-Curl", "colour": "#C0AA56", "exportable": true, "hide_tag": false }, { "name": "mim", "colour": "#98B907", "exportable": true, "hide_tag": false }, { "name": "PEM", "colour": "#94C7E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650699002, "uuid": "7f2b2291-5607-468c-a221-79d85eb66ccd", "value": "T10305237C972FB1E7093282F2BA95FC81935647D34EC10316029D45B260ED4B9FA2BD7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650699002, "uuid": "004d7dfc-ceee-4634-82be-8bce5ec236ce", "value": "24576:Mv0q1bl2sOiIq8UFJ7VzzzKcRAH+yHYQlK:M8+0UXVL0H/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650699002, "uuid": "a9431d16-7b1a-4396-a4d9-2f8d25e49f0f", "value": 813502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650699002, "uuid": "c8ebe34f-987a-4b42-b5ac-6ecece4ffb2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650699002, "uuid": "bf707752-895f-4ce8-8780-eaf07d7e3db4", "value": "mim.b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eef57e-c2f6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mydoom)", "timestamp": 1650712437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650712437, "uuid": "e663a36e-b080-465e-8a57-3ca8b7ddde45", "comment": "Malware payload (Mydoom)", "value": "057aad993a3ef50f6b3ca2db37cb928a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "satancryptor", "colour": "#E6BA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650712437, "uuid": "93757abd-2db7-4d16-9b7a-a1925f41c0ed", "comment": "Malware payload (Mydoom)", "value": "dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "satancryptor", "colour": "#E6BA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650712437, "uuid": "ca967662-7bc0-4cf9-93e9-a3118ec715cb", "comment": "Malware payload (Mydoom)", "value": "a57592be641738c86c85308ef68148181249bc0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "satancryptor", "colour": "#E6BA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650712437, "uuid": "17ef5e2c-5808-494e-b1ea-446feae64fa2", "comment": "Malware payload (Mydoom)", "value": "968570504b8813a7fd741192829bcd73d0ecff82b3b7db6a504ef02622d4f19e61e6455e33649a5d9ad9423cedad3133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false }, { "name": "satancryptor", "colour": "#E6BA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650712437, "uuid": "e17b6443-618f-41f3-a8f2-24c8a553c282", "value": "T17795336F3AD98F34E9D71038B64D544598BD52C709A679D3A83AF932A373CB3C90A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650712437, "uuid": "07a54e0a-7965-4da8-82e9-f92daec05532", "value": "406f4cbdf82bde91761650ca44a3831a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650712437, "uuid": "8fe09d11-edce-4760-954b-7cf8682f3e3e", "value": "49152:BY/3BNLViG5jQWArXncSxhBfV7xLE1t+XgWJz5qtAj6R:BwgG5MWMX7h8+Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650712437, "uuid": "7a3cbd42-ea7a-4da3-b6b7-71c251fcb796", "value": 1883136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650712437, "uuid": "1587b0e2-5e08-44af-ad70-42332c62da30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650712437, "uuid": "95566f9c-c565-4da6-bc82-166c15cf67a1", "value": "2019-12-18.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c365e5f0-c359-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650755083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755083, "uuid": "9c2fbdea-393d-44b5-a271-94d8181a7981", "comment": "Malware payload (Gafgyt)", "value": "83e5369793c00de733e6a05920d4f0d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755083, "uuid": "a1587775-d3e3-4216-88c2-8b6af5108def", "comment": "Malware payload (Gafgyt)", "value": "deab30ceed6ff4f019c3b11830a868edc52f81df71fc9a9b47eeade7c827ade2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755083, "uuid": "48a9de19-b64b-4263-a057-f9f47a52b593", "comment": "Malware payload (Gafgyt)", "value": "a1b68909f3f0f2de01bb09b84c7d3fdd98412d7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650755083, "uuid": "456a7532-e802-4ee0-b577-3146a1334567", "comment": "Malware payload (Gafgyt)", "value": "461bfe3f3d613252f7f0c6b7ee801089da41d264c0fd2f3b9458ad0f0533c7a37a6ea0eead819ecb463979c3535d124d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755083, "uuid": "ebd98c83-fbc3-4f20-83d3-57101e3ebe0d", "value": "T1D103E19EF46C9251CAAE4E39E54D69F85F0630D625C60F4D4F850ACAF7AA10B704D0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755083, "uuid": "0ba614f0-8a45-4d1e-bf20-7ef3fb6f83b4", "value": "768:zlEYZ+SKJ9bK5k8bjqUapOMowSYkBqpiFfF8MXyw8YOTW0vQN7MhcC3H:ZUZyCUw/kBqmfF8MiVDFNhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650755083, "uuid": "a8b742d1-3100-48dc-8cb7-1f70b8835575", "value": 39004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650755083, "uuid": "9c9e6434-0c6b-4578-a12c-1705509598d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650755083, "uuid": "9ba54a1c-30e2-47f8-9fe4-f2d49f76d339", "value": "83e5369793c00de733e6a05920d4f0d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d443fcd-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650674569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674569, "uuid": "91a81efe-68c1-4659-86d0-25d3c541188a", "comment": "Malware payload (Heodo)", "value": "1e505fb1f66b752ddfe47ec189348c35", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674569, "uuid": "e5adc1b9-7ba2-471a-9a4e-41d31579dcb5", "comment": "Malware payload (Heodo)", "value": "dfed9f51a681f6a884a374bd831c845e24fcb90103536ddcfce3b6264cdb2ad9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674569, "uuid": "c4b7b516-4dd4-4592-ab8a-d51e75904a4c", "comment": "Malware payload (Heodo)", "value": "52142dd282b69eee4d9b3aa846c6998f5ef8b7b6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674569, "uuid": "4e5810b3-eb18-4ff6-8a9b-a655b4bf5069", "comment": "Malware payload (Heodo)", "value": "6abdf482d695af226d3fecd9afc4b6fb1af3260092aae24c53af41a8a66985f2765d9cd94b12e68ab74045b9d7152535", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674569, "uuid": "ad022f09-9b30-4044-b39a-2a5f91d8ffcf", "value": "T1EBC46C11F6AC80B5E07BD13DC9A3865AE6713C984B7943C79251EB3A2E736E15D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674569, "uuid": "7ce46b34-2bfa-442f-a0ea-d1abca586fa4", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674569, "uuid": "f53dff3c-3568-47f6-98b0-cb5123049943", "value": "6144:1oJyHSfFIDAqBcJ6EkVgNazgHH6mXZOs4z7N9nAMieHiL7iinzGCvCsP5Ot2:C1FIcocJwMTHzXO7N2MBHiyzsk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674569, "uuid": "274f904a-811f-4895-bb24-d6e5eafa124b", "value": 547132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674569, "uuid": "01aa8009-3529-4f93-b9b7-d89c6b48a701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674569, "uuid": "c5ca87a7-1d1e-402c-8684-973d45f59f9d", "value": "1e505fb1f66b752ddfe47ec189348c35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc2e99e-c2fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650715913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650715913, "uuid": "2f7b9a3c-cedd-4016-aacd-f6ecebee80a3", "comment": "Malware payload (Formbook)", "value": "ab6dcd0c0539abf46f5a658898698548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650715913, "uuid": "39d44f17-ae23-42e1-ab67-a891e2753d20", "comment": "Malware payload (Formbook)", "value": "e0baa3e4b53099cd3bcae88e19f64801568d1b9dadfca64f4d128cb4d399ab33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650715913, "uuid": "54cdd64a-8267-45bd-924d-5ccee30f52c0", "comment": "Malware payload (Formbook)", "value": "c6f832bc939bcd256c822ef0b023a8183d37acde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650715913, "uuid": "8a68c0e2-f5b4-4bf6-a1ac-45cca9ca0db4", "comment": "Malware payload (Formbook)", "value": "b6ac975b0e1321b31ff21b43d7b3a900dfb0848aaaad8659b59b767e458b437af35a9bdd2ee618f3f2b6f960ae39805d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650715913, "uuid": "2d3dd9e1-b37f-4f3a-b352-7d615ac8dcdc", "value": "T15CD49DE2CDB0250EC9549B38E0D3CCB0E5DDE144506EB78878705B172E9D7C4DADA7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650715913, "uuid": "744d769a-16f9-49f8-ab6d-7139a88acd10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650715913, "uuid": "38bdc083-fb10-4b0d-9746-81c5e2035f1b", "value": "6144:DR7n7XiXZrPZ0uRyIjD7GA6iq2Bhb2k+wEvsR5Q7Ig1aTZWxoOv+f3y6UEz:DkJrxa4mdGhbX+wPMhNcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650715913, "uuid": "1063b5eb-62a7-495e-bddf-6c720f9f0f64", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650715913, "uuid": "b58f3b4f-376b-4996-91c3-823658bc5bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650715913, "uuid": "06d4f943-5191-4f9b-bb5b-04b39df7a39a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a77e755-c310-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650723581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723581, "uuid": "a94bdb45-b6cc-4073-9ebf-eca7938383d8", "comment": "Malware payload (AgentTesla)", "value": "f5b8a43717e3c7105cd6c48cbf058cf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723581, "uuid": "881847ae-8d6d-4750-ac02-7dc2dc14a34b", "comment": "Malware payload (AgentTesla)", "value": "e0ce0a7a8a0c138e1381ae308ff6aea962515feaa6f5cb4a1066894757100173", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723581, "uuid": "dc5220b9-db35-4668-8ead-9ba25b9ae056", "comment": "Malware payload (AgentTesla)", "value": "b84b9244bcbbb2aef12755c62b18cb5d67b55c23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650723581, "uuid": "b50e5d4a-0fb3-4646-9bae-3c37012378a7", "comment": "Malware payload (AgentTesla)", "value": "b3b45f8512207f69af3ea99706f6e354bdc98791abbb26c8672f0660812651a5a7a6f0889f0b7016b21961a08f2bd05a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723581, "uuid": "37b7dccf-d2e5-4610-b380-f1230cd37c63", "value": "T1A3D4026772921F88D4112379C1C60B42D3BAE435B661A7DF4F29FC099DA3A8EE413D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723581, "uuid": "60a63016-9e66-45dc-81aa-3c4f83e54fc7", "value": "6144:sEdCkS+KkKgD/uGSxtJ7Rmt66CjUlKhf0YVz28v6tO7A8SWxb:1S9wD/uGSl4t66Ch8YN0tO7AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650723581, "uuid": "c5422e59-c86c-4488-bed3-513064330681", "value": 621013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650723581, "uuid": "f0a7edfb-d0bd-4e53-90db-8aba9ed7bdd5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650723581, "uuid": "ced55e52-9205-4ced-80ae-6d81736cb3b8", "value": "PO10210.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a341c2-c2a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650677462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677462, "uuid": "69ed557f-1f6e-4bbd-b816-4e55c556dacf", "comment": "Malware payload (Heodo)", "value": "2dde5ba4d352e451ebf75e3d3e943520", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677462, "uuid": "31815e7e-7e32-4a86-9245-89f4e53aab13", "comment": "Malware payload (Heodo)", "value": "e0f2b747a1216dd971d1876232aff7fd27b5b24ddbc615465812f033f2ca4fe2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677462, "uuid": "c529a373-2e9a-440d-9517-c51fec6b208b", "comment": "Malware payload (Heodo)", "value": "b785bca1f0dcc5786eb592127be921733e4460ea", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677462, "uuid": "5e640355-6794-4ef3-88e3-b751e37ec124", "comment": "Malware payload (Heodo)", "value": "bb80fa547eca1f81b6a016cb2d2174e4c3ecbc6a587f4d3b458bac973b2bd92307b285858be26803897e3f95fc44ec58", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677462, "uuid": "d64d6dd9-47f8-449a-9572-022dfa2af31b", "value": "T148D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677462, "uuid": "856fd995-9444-46f3-8053-4ed973ae1b37", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677462, "uuid": "159808f2-04b2-47cd-8681-070f2282d3b7", "value": "12288:C1FIcocJwMTHzXO7N2+BHiyzskF1CubVnmn:tco9MTHzXO7Nf/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650677462, "uuid": "a365d697-9863-4604-9df6-7c58120b5ee7", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650677462, "uuid": "3bc8ab08-b3bb-4b3c-8b32-df39d358fab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677462, "uuid": "e21475af-6354-40e8-9258-78de4bc3ecd9", "value": "2dde5ba4d352e451ebf75e3d3e943520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0498a386-c2a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650677454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677454, "uuid": "cf95cab2-cded-45b3-9462-5e6c8313bf9a", "comment": "Malware payload (Heodo)", "value": "f8dd029cc002859a040279eb02b1d227", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677454, "uuid": "11d23bcd-c60e-47ef-8b1a-b2a20b98cb1e", "comment": "Malware payload (Heodo)", "value": "e11bb2a870712d9b8b88a925a026352d746f52f98c0693415fc4522a0de8f39f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677454, "uuid": "bd6eeb62-4af9-412a-8b21-82e7d2a43552", "comment": "Malware payload (Heodo)", "value": "17bd2b8645f1e5aa707fd26981c4bcaa37d6c18c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650677454, "uuid": "7aeb7d3d-d8b8-4e10-be60-784a0037ba94", "comment": "Malware payload (Heodo)", "value": "84739e75611d323f2a27410317fac6c1f427ab03e3ad056251d0e3e00af29e0f9ba1b94e4d9716e87b184a5af7b0777c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677454, "uuid": "7a456288-ed39-4e70-b20a-d876d6a6deab", "value": "T130D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677454, "uuid": "d8839539-2530-4484-adf0-c13ad629a837", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677454, "uuid": "cfb86bcf-2802-4132-abe1-4c91cc568ed7", "value": "12288:C1FIcocJwMTHzXO7N2bBHiyzskF1CubVnmn:tco9MTHzXO7Nm/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650677454, "uuid": "76872920-2dbe-47ab-8c7c-c1b43d9fd158", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650677454, "uuid": "af5f11ad-ff03-48dd-9612-c1f2114bb3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650677454, "uuid": "14203310-ec8b-4e90-9e9b-836ba526b359", "value": "f8dd029cc002859a040279eb02b1d227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de012082-c356-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650753840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753840, "uuid": "9b3d021d-891f-447f-9147-9f737ed0e067", "comment": "Malware payload (Gafgyt)", "value": "d6a78f476ae6d1280bae887fd6dadf5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753840, "uuid": "2f62fe50-e46d-44bd-9bc4-0f5959ab2333", "comment": "Malware payload (Gafgyt)", "value": "e2f8ce47ed3bd13e0d13dff1d78bc738245613271c45011e977ffd4ddd843040", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753840, "uuid": "26cf9cd7-eb22-4fcc-b1ad-38bc3ae82b2a", "comment": "Malware payload (Gafgyt)", "value": "f75ee6990bbb413199f48b8e2b3f190785338b8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650753840, "uuid": "54dd8746-41f5-452e-9715-85d913bb26c7", "comment": "Malware payload (Gafgyt)", "value": "40fe102e19f6e4a3b80d5f04401fb5600d254c038c713f6d1bef81fe1c2e2b654dbd1ade55f73f36bcc10b2f00960d1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753840, "uuid": "8d601aaf-4c63-47df-aa3c-16c21f639578", "value": "T15913F1511C0DDA15FB30AD3BFCED0A86F70018E8D65358774AB014B86F8AB0E9CF8655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753840, "uuid": "cecd7626-0594-4184-aefc-75044149ff37", "value": "768:Tgp7SIOqY12Ojl5JlcJKT4+5mrkHe1hLSbH/k+lPjfy/ueI9q3UELqyMNbXZeZr:TITYpjzJ+4E+5mrkHeTSbH/ksP2/XxLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650753840, "uuid": "9bc17268-4c3f-4fc3-b4ca-b00475603b8b", "value": 44740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650753840, "uuid": "b38d7c0d-43ea-4b30-bffc-1a8b1c82cdad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650753840, "uuid": "02a9479f-0315-4f23-9602-f2f23372c776", "value": "d6a78f476ae6d1280bae887fd6dadf5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0e7460-c2ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650695210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695210, "uuid": "381108ce-d826-4829-bac4-3f8ba2424410", "comment": "Malware payload (Heodo)", "value": "e9e8d8ff2966d957118bc2afe2fa9016", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695210, "uuid": "45a03cd8-c7a5-42ec-b5d6-9864b9387dc8", "comment": "Malware payload (Heodo)", "value": "e30b0575358058d2889447a38a1362ca185f08a095d92d24fdc6b89e4c3e96e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695210, "uuid": "dcebc1fb-20ea-4062-a198-10045cf47447", "comment": "Malware payload (Heodo)", "value": "75089cb0fe34c5ba73ed38fd3adde608db5df34c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650695210, "uuid": "1c59462c-fc14-4dea-b13b-04dd021c6038", "comment": "Malware payload (Heodo)", "value": "b1cc0566dd47318ec83c87bc9f20c6a95d7ff0f6c56df21167a49d394f5b9208c37f9be6e9730b19a1a390a5c38b82e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695210, "uuid": "998f632e-57ff-4824-ad34-29abf01c7928", "value": "T179F48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695210, "uuid": "1754119c-7e6a-4ad0-95c8-d6df649aae10", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695210, "uuid": "5e22ee43-d3b1-4d90-b253-9afc50d84318", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjai0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjHT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650695210, "uuid": "b1f6b21f-46d9-4ceb-8c1b-811cfb170e95", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650695210, "uuid": "09af245a-c092-4bbd-95e5-f6be7680a76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650695210, "uuid": "affe4f61-2650-4ae7-b5a3-32a34937b151", "value": "e9e8d8ff2966d957118bc2afe2fa9016.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fb33ff-c29e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650674587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674587, "uuid": "39c39bec-c9b5-4c09-9dfe-1f73bec7a801", "comment": "Malware payload (Heodo)", "value": "102e1ff9c3d873f25643479f1c84546d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674587, "uuid": "fc8d6ea0-b1bc-4b41-a819-56a6ad63d388", "comment": "Malware payload (Heodo)", "value": "e4be254caac6066c626ec2c195f191830799472f3a55b69693d95218af0eb19c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674587, "uuid": "136b8630-fc81-4e3b-b209-76d5a3a80394", "comment": "Malware payload (Heodo)", "value": "749c07d0d3e21e26164561f44b6399712df13323", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650674587, "uuid": "ea659c75-28c5-4adf-8c81-028dab511dbc", "comment": "Malware payload (Heodo)", "value": "6b9ceb476670597eaf0cdd2f7b3179cd9c7b8cc664ff52c3879684518357403b184f146c0f5c9c6dc76f2ae55b1cdd51", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674587, "uuid": "6a3b44d6-69ae-443c-a87d-8a4c2d48c62c", "value": "T17CD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674587, "uuid": "c1cedefe-f5fc-4339-8e68-34eab377ec2c", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674587, "uuid": "31fc4f1a-3081-4ca8-b7f6-7085220da27f", "value": "12288:C1FIcocJwMTHzXO7N2QBHiyzskF1CubVnmn:tco9MTHzXO7NJ/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650674587, "uuid": "84581ce0-7151-403c-8261-51f2a574c354", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650674587, "uuid": "857ede78-72d1-411b-b757-e9486b3b6285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650674587, "uuid": "2e23a239-ad3c-449b-a286-e33a311b1708", "value": "102e1ff9c3d873f25643479f1c84546d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1aeb89f-c31a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Snake)", "timestamp": 1650728022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650728022, "uuid": "5f5a4c63-a920-4568-a2de-517e239fc540", "comment": "Malware payload (Snake)", "value": "3d1cc4ef33bad0e39c757fce317ef82a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "Snake-Ekans", "colour": "#0136DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650728022, "uuid": "4dd9d9ff-9bd5-4bfd-9870-a31c36c32239", "comment": "Malware payload (Snake)", "value": "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "Snake-Ekans", "colour": "#0136DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650728022, "uuid": "768bd6e9-6319-4539-b0de-b2004cb3f8d5", "comment": "Malware payload (Snake)", "value": "f34e4b7080aa2ee5cfee2dac38ec0c306203b4ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "Snake-Ekans", "colour": "#0136DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650728022, "uuid": "4fda9e73-a33c-4c1c-a710-c472e2d80b97", "comment": "Malware payload (Snake)", "value": "5ac17ded8b36f4204aa02b7caa6a4f85e1e35eb9d66ec4d21da4a4acf19e87d30c9700e787a54b82654e689bb293a0ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "Snake-Ekans", "colour": "#0136DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650728022, "uuid": "c7133d74-e0f1-4bb6-9720-37abe681797e", "value": "T1C606FA61E9EB40F9F60B457018AB662F63313D198739EEC3C6543E17E473AE10633A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650728022, "uuid": "4e644145-714d-4812-b28e-e7ada9f76e9b", "value": "96c44fa1eee2c4e9b9e77d7bf42d59e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650728022, "uuid": "8d0255bf-13e2-4122-9c7f-7d887ae8b1c9", "value": "49152:QAdGB73ejP3+EMfRdASVaAvrC5Xh602+:QAgR3epMjASHch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650728022, "uuid": "9323a062-f3b9-4b86-9687-13ecddf3845c", "value": 3718656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650728022, "uuid": "b892e339-969c-4bf7-940e-bef65d7847f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650728022, "uuid": "5cb34862-2106-41e2-a5e2-15643c10086a", "value": "update.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467f3177-c2c6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650691738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691738, "uuid": "5e9d31a3-c9a8-4db9-ab81-420d337b81a2", "comment": "Malware payload", "value": "3302e3cfef042c7917eda19b95412ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691738, "uuid": "ef1a388a-d058-46e2-a86c-205790099b50", "comment": "Malware payload", "value": "e5894d046870e7aaa1c3451159d1950f366497aa5ee7421c688d507670fbc73c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691738, "uuid": "692e1f71-805f-4d89-af29-e0d7c446c9b9", "comment": "Malware payload", "value": "4be1b8a14625e6f05e6f57fd3f8ef89bb29bfb3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691738, "uuid": "50b418bd-fb6a-4dc4-bc8b-5b5b6b5a1405", "comment": "Malware payload", "value": "b877938a024252db67c77cb96f50374f99594b8157118236bb44f3ef6f84ee873df66b59d0e1e2a90e2eb8378630308d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691738, "uuid": "b92fb494-3c7a-4af0-96b3-fe6ea4b8ce5b", "value": "T196955B9D96A64805E900A3B8DCF37F682719DE75186B5307A3753A3AE03FB640E457C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691738, "uuid": "a606dd5c-a52f-4780-9fdf-d8493a63cc66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691738, "uuid": "84167317-b2dd-4037-9c99-0533f87d7cf6", "value": "24576:7sDuHWnKd81O4/bJfoTSlw3ejKxYHjSwOF0aFtUNGSEZa1Jcai2OXvp:4JV1O2lo+QzYHqua6V1rOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650691738, "uuid": "1ce7f9a7-4d76-49a7-aa8a-bd812e914f47", "value": 2028032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650691738, "uuid": "547a23b8-f4d3-4dd8-a9e1-c00729be702e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691738, "uuid": "7e7ea584-eb67-474b-b392-415936a01743", "value": "REVISED Po# REF476 32165 ATTACHED OPC 202204130851 UNINET 1016WM02R1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3916fd15-c2aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650679689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679689, "uuid": "f6a58813-5eb8-4ac4-81c0-ea2200c70ee1", "comment": "Malware payload (Mirai)", "value": "79765e815e6d0e6a1ca81c85aa443b90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679689, "uuid": "de47e3b9-ea64-4fa6-b8f5-a30c7aba78d8", "comment": "Malware payload (Mirai)", "value": "e615326026cd578fcfbe20bd939a275905b0179ebaef24f87c70445247458646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679689, "uuid": "a9c4d294-ad2c-48cb-8a99-af6571836977", "comment": "Malware payload (Mirai)", "value": "dfdf3fb5aa10b2b67b99ec0e93b365b84924a4e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650679689, "uuid": "03e08cf9-803e-4c00-b166-e991c8eaf819", "comment": "Malware payload (Mirai)", "value": "9030efd955c74560dd35d1d4aed6b7247f67df5d07848963922dc76a9c58d1b60a6d9038504d8177a4709718fd8cd429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679689, "uuid": "df9498c8-eca5-47e2-99ef-b0560ef58781", "value": "T1FEC2E192DA07CFE2FBEEE9204AA2D7C26391065F3D239D94D4D6DB5500336699A01DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679689, "uuid": "077e6eff-e53e-4a79-a278-7a7c756c6386", "value": "768:rYz60p0/ToXsPBOapk4jlwI3WvrRUJ5Uk84uVcqgw093:rf0M0sZO5EWKJ5K4u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650679689, "uuid": "18f7cf1f-c71a-4b8f-9196-f0a8952109ed", "value": 26252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650679689, "uuid": "8888d0c1-b079-47d0-b1a1-962a48921004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650679689, "uuid": "59d4f702-485e-437c-bbcd-be91e4a4562d", "value": "79765e815e6d0e6a1ca81c85aa443b90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152732cc-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650693373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693373, "uuid": "a2e76bf2-3f89-446c-84f2-6e8d8b285b98", "comment": "Malware payload", "value": "f8ac6ca779c015af12698d0b228249ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693373, "uuid": "39c4b509-c6f0-488e-a1f4-b2d32f655b48", "comment": "Malware payload", "value": "e870ad2f91e7ed62a1f5b39ed099609d0ea8d04f5eae863d3b180fc4b7c87d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693373, "uuid": "9acd14d2-c8da-4152-bdbe-6b248ec4b944", "comment": "Malware payload", "value": "8a6407306a7fa16ca99080c234605b0efdebf4db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693373, "uuid": "c5c92d9f-cb13-4ffd-a22e-dabac23f7452", "comment": "Malware payload", "value": "7d9e8c7ee39d4fdbf0a5074b130db8bdc53cab4a6220b7656cd1075381aa62ca64df1f939a92165673a0cf7b1e56fe93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693373, "uuid": "cf7961cd-d943-455e-9b9c-136f029bfe3b", "value": "T1E51612BD62887758C41EC8701533EE05F2F5912D03F8D99AB6DB7E803FAB824D516B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693373, "uuid": "581d517b-6f3f-4cdc-94e6-23fb4463480c", "value": "3a7f73b06c8f2c140f105c17406271d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693373, "uuid": "f17717ef-bded-4380-aa72-26d5131b143d", "value": "98304:2ycFIa6F5JYVRuW9iFAJldRQ5IOaaSy+:5F5JYUOJfRGXac+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693373, "uuid": "44414ca8-cad8-4123-b35a-2e291c1271d6", "value": 4022784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693373, "uuid": "7209e047-db5e-46c0-8762-95d08174e9fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693373, "uuid": "afef64c1-e7e0-4819-a759-53c51b7d8cab", "value": "f8ac6ca779c015af12698d0b228249ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1753c77-c2b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650685904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650685904, "uuid": "c6ffc296-6788-4800-8651-806412eaa6ee", "comment": "Malware payload (Mirai)", "value": "74a96f1cc83eb257431cc2d5e0e99084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650685904, "uuid": "36d3ba5d-4bec-4bed-93f8-5a78009338bb", "comment": "Malware payload (Mirai)", "value": "eb55e830b17e4f5a026c3cd8126a8a7d9b299bb7cbb3924155b90af30f2d156a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650685904, "uuid": "caa23ee2-0e7a-4f7f-a473-5e85a810cf28", "comment": "Malware payload (Mirai)", "value": "a3ce41fa0bdd1370b49de014a97d227ae91ec6b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650685904, "uuid": "317815e8-1381-430f-8440-3cb88855d010", "comment": "Malware payload (Mirai)", "value": "9fb7a8685e45592dcc2fae748ea605368345107f7bfb797b92e6f170aba39cf34e7ad5e72e07de22817c92b50a714a03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650685904, "uuid": "207e8d79-c796-4fc0-b866-6d39d885f31d", "value": "T1EC733A25B9791E36C0D0B57E11FB8B01F6E1228E26F4C51A3DB20E5EEF247406952BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650685904, "uuid": "2c10acac-a49a-4e72-9fb9-1302cc92a6ab", "value": "1536:1gfq/SnNLlYfpDFQS2OX+msMmsRoe6vfL7rLQm:mE2Md0rvfLbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650685904, "uuid": "daebb4ad-3306-4650-aa32-0a93f01d9e4b", "value": 75504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650685904, "uuid": "6eb2cfb2-cbc2-4531-a02e-e5112f572bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650685904, "uuid": "3c378f9d-2658-4c4e-8cc2-8477478ee50f", "value": "74a96f1cc83eb257431cc2d5e0e99084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92058093-c353-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650752424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752424, "uuid": "f287d062-7470-4ab3-ac1d-c5af6217db95", "comment": "Malware payload", "value": "03ef1be589f77403cd2029ca0c9ce390", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752424, "uuid": "e09ee7b0-d699-4982-9006-4070f173c1f5", "comment": "Malware payload", "value": "ec884627e694054bd5a1d1516c01618fa66a84ba7ec17427e5035c69d7160cbc", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752424, "uuid": "1e25e9d4-f36f-4059-8a6f-6bcec31a1e5a", "comment": "Malware payload", "value": "1cc1949afc53be74d7d10d38381a5bed037b65d5", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650752424, "uuid": "5588990a-81d8-4ded-bda0-b9c45fd09d75", "comment": "Malware payload", "value": "e850503dab4a515f526e1007892e4785268af7647b8b0542ff6f31bb27565314484bc4ebf55e5b0ba49bd8dc3e7286d5", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "roseannmortali-com backspinnews-com", "colour": "#E077A7", "exportable": true, "hide_tag": false }, { "name": "windows-11info", "colour": "#B9E48E", "exportable": true, "hide_tag": false }, { "name": "windows-server", "colour": "#7CB178", "exportable": true, "hide_tag": false }, { "name": "windows11-infoserver", "colour": "#5CC2F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752424, "uuid": "e1282022-f685-4f09-af74-0586c9be8721", "value": "T1FB7723FBA258603EC46E063245B3927C493B7A5DABCB8C1E57F30C1DCB2646C1E3A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752424, "uuid": "c525b88e-ee78-4eb9-a060-c0da5066f38c", "value": "393216:DADI2pKcRFzhEWw8SADI2pKcRFzhEWw8SADI2pKcRFzhEWw8H:DAwwU8SAwwU8SAwwU8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650752424, "uuid": "157707ed-f24f-4376-be62-5b292bb1f641", "value": 35821568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650752424, "uuid": "048b85ec-7628-4035-a326-41eaa3b71bc8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650752424, "uuid": "bdb54bac-6983-4727-957d-5ea9bae5987a", "value": "Windows11-setup_11.7798.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10154b7b-c299-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672319, "uuid": "d9846e6b-2649-478e-8dd2-07a6fdb86131", "comment": "Malware payload (Heodo)", "value": "2d46f9a41a7a05f454febb684055d399", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672319, "uuid": "0091f4f1-888e-4801-9c21-48e5c8136a6e", "comment": "Malware payload (Heodo)", "value": "ed34d9abab9b05ea1163f4b2e73c3afe60d84293fe7cc04aaf95775332bf8222", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672319, "uuid": "dec58fe0-d21e-4061-b484-ce68f24f4b44", "comment": "Malware payload (Heodo)", "value": "1fa3779fb831f3fbba1343967fb449facb1f7488", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672319, "uuid": "e91e0e03-0cad-4843-84b4-69a5314b5a84", "comment": "Malware payload (Heodo)", "value": "f09423261ba3beb67de511b013cda76ac7f7efa0338c75899490391a3823e714fd92b4b5bf0ce6633bde553671b2b402", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672319, "uuid": "b5f64dc4-76a9-44ca-a468-0a6bfc0b1354", "value": "T11EF48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672319, "uuid": "ab5256ef-00fd-4fdd-856a-1ae23f06e460", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672319, "uuid": "5bdea730-8731-4bbf-bcde-4226d42810e0", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjqi0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjXT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672319, "uuid": "b5d54496-fc85-4480-b585-a3ae6ccf71a6", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672319, "uuid": "2e6a895c-3266-4914-8a71-89f10e1b23d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672319, "uuid": "70951a01-334b-434c-9e56-aa4a792fe09e", "value": "emotet_exe_e5_ed34d9abab9b05ea1163f4b2e73c3afe60d84293fe7cc04aaf95775332bf8222_2022-04-23__000513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633a418f-c2b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650682767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682767, "uuid": "5b57bec5-20e1-4c8e-b412-066d6059655a", "comment": "Malware payload (Heodo)", "value": "48edc8ce9f8f0510dc0f2996eb7c79d0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682767, "uuid": "fdcfb8f6-e1f4-4be1-8d3b-b70dd2416606", "comment": "Malware payload (Heodo)", "value": "eee3bac5eeedd69f41fbd4f507908cb890745d28f8627a1d05aee489108a1081", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682767, "uuid": "a9e51627-d7a0-4277-b027-8a11d6b0c56a", "comment": "Malware payload (Heodo)", "value": "4f4736ec31085fc0c2a8baa9e770bee2b154e3dc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650682767, "uuid": "d6dba9fa-b94c-46f4-8185-ad5f872f2e82", "comment": "Malware payload (Heodo)", "value": "f8a1edcb3943a81dcdd4388bb8d92131d045dc66629d0cb8424ca051d35458f8f6016148c98b1016aabee2510c589773", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682767, "uuid": "6f0396d9-379c-45a9-9e2b-4b10b07ea9be", "value": "T100D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682767, "uuid": "4d117acb-d1ef-43f3-b6a4-0b5e6179b6bb", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682767, "uuid": "bd343bca-9176-491c-92a6-7df62f56a63b", "value": "12288:C1FIcocJwMTHzXO7N2NBHiyzskF1CubVnmn:tco9MTHzXO7NE/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650682767, "uuid": "e5cad04c-0373-44ee-8c24-1f2cb238b6c9", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650682767, "uuid": "e2056673-b4fe-4ab6-aee5-eac0fce2ceb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650682767, "uuid": "76b3a6db-5557-4007-ae7f-74322d0756f4", "value": "48edc8ce9f8f0510dc0f2996eb7c79d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679b4290-c302-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650717563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650717563, "uuid": "2e1ef23a-1abe-4d31-9304-dc5b4c22dbea", "comment": "Malware payload (Heodo)", "value": "f9af6f38eeeb96038d85a18999399a8f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650717563, "uuid": "ff93617d-be42-4e27-a69c-c124834e63c4", "comment": "Malware payload (Heodo)", "value": "f169ef3e0beb467aaaec5c9560df7200430a5b41beeefd92a429c1da85e57047", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650717563, "uuid": "14b59f21-6b71-46d0-a312-3ba9d81b0f52", "comment": "Malware payload (Heodo)", "value": "bd8a191e5456b63c083c6596abc0015afd9ef8db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650717563, "uuid": "61af75f9-9705-47a6-b573-28f391d5cb03", "comment": "Malware payload (Heodo)", "value": "be2657b2065b03e7a0819312346b465ba985d86ce29bb1ff2d9f26f75fded9fb38b76d5927122515e6c84273c941ac38", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650717563, "uuid": "2c89a29a-7aaf-4c3d-aa1c-0ee9a3d5e409", "value": "T19324700233C361F0CA53B574800FE525BCA7B53C6B15497DA14BA5AF87EB8D09A349FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650717563, "uuid": "b9b4ea4c-84a1-406b-8f36-6de4d0dc81fa", "value": "3072:4TdrXJjOjQyNo6BUv1gr8qcKRXyMjO8rSXVKfp8GSaztT2g:S5uok8qcKhyMlSXVKfKGS4TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650717563, "uuid": "c4a8d78c-7e3f-4f63-b58d-65641ae1a8ed", "value": 220992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650717563, "uuid": "6a6420e5-77ea-4bd3-a3b0-803544cd64d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650717563, "uuid": "e25f04eb-d4a9-4c4a-87a8-88b3eec68446", "value": "emotet_exe_e5_f169ef3e0beb467aaaec5c9560df7200430a5b41beeefd92a429c1da85e57047_2022-04-23__123918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f116408-c2ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650693390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693390, "uuid": "aced3f9a-33d9-445c-9da6-5721320eb183", "comment": "Malware payload (RedLineStealer)", "value": "ca6c6a63d78958267c41a6deb5a10ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693390, "uuid": "f7cf1a8c-2911-4494-9c91-348ea80133aa", "comment": "Malware payload (RedLineStealer)", "value": "f17a9aee6d029b4ea29e918e81f30a230c7624c771fedf7056166774376b253a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693390, "uuid": "ac9d4c07-fc5a-455e-a073-019811289472", "comment": "Malware payload (RedLineStealer)", "value": "93bc060154e61ff06dba0d3ad1efd732fadd411c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650693390, "uuid": "2f3ccc5a-bd1a-4297-b7ed-058b62b7ef60", "comment": "Malware payload (RedLineStealer)", "value": "62216dc5e6822e6cf98dcb1db0e3566cee2ed53f18fdfb4426c221e39d5b59f113a3a9575d08db3a7700dd7d4badfa50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693390, "uuid": "71b198e9-13fd-4e5e-8250-6f8a74cced68", "value": "T12016013FF268A53ED56A1B3206B39210997BBA61791A8C1F07FC340CCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693390, "uuid": "a4e74bd9-ea9b-4eb0-ad1b-fd9482fcf798", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693390, "uuid": "a48d48f3-cd00-449d-825c-f7567efd3de6", "value": "49152:tBuZrEU7eEyO/MPTqoPQ3urhQdY4Lu2AaY8xtB/PDIg9wYPgVpNXu55DdN7POGjd:7kLCW/MPTZPYgKdY47h9V3sgpPD55ljd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650693390, "uuid": "3e201639-e04b-4c10-b2d9-80b374d4fd5a", "value": 4229769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650693390, "uuid": "fb68e267-6cca-471c-a82d-8a53ab7463b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650693390, "uuid": "7524ff0c-e91f-4dbe-bbb2-c3ba70f41e50", "value": "ca6c6a63d78958267c41a6deb5a10ec5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51691c0c-c328-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650733847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650733847, "uuid": "b65d3dd7-2a98-4e4e-a749-8df13d340dfa", "comment": "Malware payload", "value": "2e5bd699585fd947c6e8494986b3231f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650733847, "uuid": "21babe23-5509-4dbb-bc3f-763bb59ab0b7", "comment": "Malware payload", "value": "f382cc3fa5ba656f6070a3bb2a706fc65720e4b7529df15f3c5e9a0293f4d87e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650733847, "uuid": "01497ca9-72f8-47ca-8ff8-abd405ddabee", "comment": "Malware payload", "value": "3f019c46f890193f84433403f39843c701e0408c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650733847, "uuid": "3a2caeea-0c38-45ad-af2c-0ce01153a8ca", "comment": "Malware payload", "value": "63b41d2e521118190876c88f26ee39e1b2570061a61e13667fcdc88a3038b396ac9719507fb2d7a61d304e6407bd3c09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650733847, "uuid": "13821c43-5100-439d-8ece-d8f4d93614a8", "value": "T107838781B7C2BC92064B1B77732BB1E5F5395DD87188448AF504BCA8F4BDA26FAD0631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650733847, "uuid": "1c62a69f-1425-4631-82bf-88a70fab19c2", "value": "1536:01ap4rIGB9KTr3fOsdCYMCTFaP2QRdoeYyHesvAD2men/LTJ2JSIWyucE:08p4cGOLKOkSm+svO1G3J2JSTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650733847, "uuid": "af7f7d65-4834-45d7-aa00-f304459d462a", "value": 84711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650733847, "uuid": "fa422cc9-7f0c-464e-89e3-7568a0729f0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650733847, "uuid": "5c677a4a-ea23-4f94-9822-0c6c2006b4c0", "value": "script.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18ed80c-c2a7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650678603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678603, "uuid": "b3ce9a3b-e69b-4978-8a03-5aa2a6115f9b", "comment": "Malware payload (Mirai)", "value": "6a7ad090c92faeac7429b2bab6b7fce3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678603, "uuid": "375d5857-c662-4b30-837c-3f00e21ceb11", "comment": "Malware payload (Mirai)", "value": "fa0e16d44f0e4ce4441564174130c407dc4ec1656750fb1db9332d67c10e88de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678603, "uuid": "24d3e897-7eae-415b-bf15-0a1b03f36aaa", "comment": "Malware payload (Mirai)", "value": "4e0f14c8d163fac3755f9cfe79016a8f25d5d279", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678603, "uuid": "83707ce6-ca55-4788-99ae-5210d809e2ed", "comment": "Malware payload (Mirai)", "value": "df04d214f5408bea1e03920b3dfa2043677654e7c84e45aa1bfc5a263a1d216d8f703761ca26310fdc615c4695909f81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678603, "uuid": "678f6154-0d4c-43b4-b79b-699b6d9c1593", "value": "T16933F1D1B17A4872EF251438F8AE475EBD1F46F881B790B114EC056C9EC224A1FFEA80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678603, "uuid": "7f5ac5a6-b312-46e3-bf7a-c245f1496d4f", "value": "768:UljHCLE+aRDP0uy91q/KYNtNGTVU2YCHaNTjv9q3UELQudgSFM8iCvJKaP8cQXVn:2WiDPjy91IKl5xYDNmLQYMtCevSqq7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650678603, "uuid": "7b9bbea1-952e-4185-9c87-e91371ed9baa", "value": 51512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650678603, "uuid": "de7fbb5a-af3e-4967-bf99-7e794290f945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678603, "uuid": "23a3976e-263a-4a88-8a94-dda6370ecc22", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6246c5c7-c2cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Matanbuchus)", "timestamp": 1650694791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694791, "uuid": "99fd025b-fefb-4886-8730-be3802ebaf08", "comment": "Malware payload (Matanbuchus)", "value": "f8a096c4dc133e0e99ebbb5745b02a1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694791, "uuid": "836efe3e-2d34-47f8-bc3e-34888e106f0f", "comment": "Malware payload (Matanbuchus)", "value": "fa6500946210334d397d612d5ee9b11456316e25672bc60c1267bbdb002af9c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694791, "uuid": "47af2584-1901-4c1f-8776-17b99d959c7f", "comment": "Malware payload (Matanbuchus)", "value": "1fd193ec1a9f875382ad6d2af1251a80f6e79784", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650694791, "uuid": "bc36c9da-2244-4ca7-b577-c98ba2f5d59b", "comment": "Malware payload (Matanbuchus)", "value": "848269d0f66724c2445e9fe18b220ebbdad27822cc5eb5a37dc592cb9bc6a9199693fe2f3a169a5f24af475a2bef02b0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694791, "uuid": "2b2c3eac-7d01-4eef-a8aa-88103a5270ea", "value": "T12D543911B500F132FCBA04759E749AB04A2E7E309BA805CBBE8C7F2E597F5C1A524E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694791, "uuid": "27c6dcc1-85c1-4430-97db-aeef4f8aca4b", "value": "d86e96cd523f0d88359af350afd73632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694791, "uuid": "2d9ee26e-ab59-4af2-ad1b-9de10daa580e", "value": "3072:c6mvqcGPwK96Q5OqyaH1MH/oanIAW+Z7fmq9OhqZWXYWrrRSVMnvw84XWpWeZj6H:mvqPn9BOqvmAarWq7fROnMSkdh4sSCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650694791, "uuid": "255ac60b-fa78-4692-974a-c8748b632cb9", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650694791, "uuid": "2382e22a-3bda-4309-be16-b2f08c925911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650694791, "uuid": "50c68622-afa6-4ec4-8203-97743dc3eb24", "value": "f8a096c4dc133e0e99ebbb5745b02a1b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9220e2-c298-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650672104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "3e663f85-9799-4141-9bae-62dc9fff88f6", "comment": "Malware payload (Heodo)", "value": "d6ddfeceab7662e594c311a9b2758227", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "052e9e83-ee97-4208-a0c0-906fb55eb5db", "comment": "Malware payload (Heodo)", "value": "fa83a5c0a3fb69b8e896bbf27395e9d502b29592d043ef64f3258cbfff28c3e5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "6564184c-2b7b-4f27-8e19-f269219ba636", "comment": "Malware payload (Heodo)", "value": "0be29cfba17e73d2190bd2ed759e440d04a8b26c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650672104, "uuid": "87f0aae1-ba69-4c83-8bed-3603368455b0", "comment": "Malware payload (Heodo)", "value": "0f6d53c3ab210f3fadcad8dc5c55799ef630760e8bb8b8ba78adb26b398b606debb99a4c93bed098bdb4fc8b3ac8ebf0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "e9ec1b8c-e416-431a-b7f4-12473ca13ed6", "value": "T13BD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "d3cc251a-5fef-4225-b2b1-5f4dbf7e59ab", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "da8a3f66-5030-4bc1-8236-0f60fd295d08", "value": "12288:C1FIcocJwMTHzXO7N2RBHiyzskF1CubVnmn:tco9MTHzXO7Ng/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650672104, "uuid": "6d5b2a1a-9e45-419c-9233-3d975861bdad", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650672104, "uuid": "ca49cec7-26a0-44d3-99b7-395630cc6df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650672104, "uuid": "f9a65e54-eaf8-4933-bbaf-03e6a65e5cb1", "value": "emotet_exe_e4_fa83a5c0a3fb69b8e896bbf27395e9d502b29592d043ef64f3258cbfff28c3e5_2022-04-23__000139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ea46dd-c357-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650754207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754207, "uuid": "51de3970-0163-4e8a-be1d-6b6105911eae", "comment": "Malware payload (Mirai)", "value": "fd9e7204c1becee6c5b6a4602a88e776", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754207, "uuid": "2ea72ec0-a84d-4792-8573-17600a280203", "comment": "Malware payload (Mirai)", "value": "faca6c3143ac062d6fc46089365a4e03ea2a46babb559f787fe0838f9d73dd14", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754207, "uuid": "501a9768-0910-4982-894a-403c4d1d6095", "comment": "Malware payload (Mirai)", "value": "09cf79b7f82370635f94f7bc227d0b388b2767e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650754207, "uuid": "84b7229e-9b75-4587-82ae-f8b510319705", "comment": "Malware payload (Mirai)", "value": "05146435c536e2aa1460eaf4f79b836d0c1b6ade6ffa4347bb9921d308292c5def312e12be707a17236a30e0810614ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754207, "uuid": "b969c40d-aa55-410c-b7b0-56cadf086740", "value": "T10D532885BC81DA52CAC4237AFA2E41CD371563E8D1EF72139D221F1077CA81F0E6769A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754207, "uuid": "bf41d325-02da-4054-a578-24f2cdee7227", "value": "1536:EcBmwG18KzXiFrZ4mH0o6ayT6UmT2MgPrpX3ic77:EcwwGoUGys2MG1X35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650754207, "uuid": "e27d7d84-0274-48af-8f0a-3f4fbebdc3ce", "value": 66556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650754207, "uuid": "ff515098-29c3-4bb7-8d34-5ec56fa69698", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650754207, "uuid": "aaac0635-bcf7-4313-acd6-3b66a312f7d0", "value": "arm-20220423-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65118cb2-c2bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650688783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650688783, "uuid": "a70f336a-46d7-466f-b90f-04c4e6ef5b76", "comment": "Malware payload (Mirai)", "value": "efb8a38a96704012f0f6776c9410ce65", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650688783, "uuid": "f8180220-8c4c-4e45-abf6-4a3d9ab27dcd", "comment": "Malware payload (Mirai)", "value": "fc7f45582145f33fcfb60be2d2dfb5c87f2f441f2e2535de85339df9169121c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650688783, "uuid": "420df419-831f-4f72-983d-35c80d8927a2", "comment": "Malware payload (Mirai)", "value": "ac81b9d6c49c31c40f7a16cfeaf22d565ba97ad4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650688783, "uuid": "a2c318aa-93b1-40bc-8cf2-f1eeca1a4f7d", "comment": "Malware payload (Mirai)", "value": "b36abb154aa248f9ad28dc46beb85c60310489c64163f5cc8a1823f4e785ade745904934a518994b38da894d4f927575", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650688783, "uuid": "fd1ce24f-a138-4b78-bc05-68c537f43c6a", "value": "T1FB7349C8E183E9F6ED1519782067EB619DB2E03FB174ED8BD3DC2277AA44702D40269D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650688783, "uuid": "0770e7bf-9e1e-49a4-8a4d-9831901998a1", "value": "1536:+absetU8R4sos2mXni3sKYILxewFl7Exj2l+2Eptg8SlA48rcX+XV:+jetU8R4/s2mX0YIFewFVExjBXgZA4+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650688783, "uuid": "b6aa48b6-d9a1-437e-b532-080f90109ca5", "value": 78608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650688783, "uuid": "e01add49-b280-4e5d-9066-e4b364eb4202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650688783, "uuid": "2dec1e22-be80-4a65-8ea7-c564eb68791c", "value": "zx.x86-20220423-0439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a4a8fc-c2c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650691273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691273, "uuid": "dba7847f-e3fb-46ed-9ae5-054089d92231", "comment": "Malware payload (Heodo)", "value": "0ebf35553fdeaae50b648ed419c207ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691273, "uuid": "55e4520b-93b9-4924-9e78-cdd696850a94", "comment": "Malware payload (Heodo)", "value": "fd68eea81f74039bbf932691ef2cb6cfeb0ea1cc9f2de58389eee6a1178e55c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691273, "uuid": "535ff076-fce3-45b3-a9fd-5cd8436d8c29", "comment": "Malware payload (Heodo)", "value": "9764385ffc34330e1aa2ca807fc2e3bcb951509c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650691273, "uuid": "09798f30-bf37-4091-a7ae-ddf1f447b617", "comment": "Malware payload (Heodo)", "value": "3e6c135143e55eaaae67b3beaf7a551d70b802462114bd00f8976f26ec3b32996a1b1b637a9632131de677378fcb2fcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691273, "uuid": "5c9f682b-b54c-4b67-b5ba-6a1d9a970cf7", "value": "T19BE4CE107692C472E1AE117C0957A3A457FDFCA15F78D74FBB80AAAE6D300D28E25327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691273, "uuid": "40e1967f-cb51-4afc-8b4c-5a378b5ab910", "value": "2b0f11b96fb4f36d2403b078231eb706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691273, "uuid": "8f1fcbb2-3c6e-4b8f-a201-5985ca4b8553", "value": "12288:tPSP+MOfIi3hjraTYFIyRuiS9CCoCK8JiF2m1yMu0mPVOXNZ:tPSP+jiTYFIy/S9Cs5iF/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650691273, "uuid": "8f4a81b1-1fd9-4e79-8960-6c1f43caa0a2", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650691273, "uuid": "c0ccd287-4db3-47f0-8079-f256e608fe85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650691273, "uuid": "989fde8d-0a3a-4a00-87b0-c6bb4e29f2f7", "value": "emotet_exe_e5_cbbd73b9fd17bfc870684378cc7ec58c2097b166ae9c30c35e664a69f0deee22_2022-04-23__052108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a78011-c2a7-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650678640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678640, "uuid": "b92e6232-f037-442a-8af0-e1980ee9074e", "comment": "Malware payload (RedLineStealer)", "value": "ee819a54c2ec47e3f7756409f56703ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678640, "uuid": "851eca09-7a73-48c6-b621-5e0a9b372052", "comment": "Malware payload (RedLineStealer)", "value": "fdf48447e07ec0db8209ec27315969f99789ee0672b386a8caf9b017b61d7c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678640, "uuid": "e3455993-4c0a-4a1d-bff8-1d88c1b770f7", "comment": "Malware payload (RedLineStealer)", "value": "ff978aaf222266004a2571c37618731a34d20445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650678640, "uuid": "e38b8afd-876f-417d-88f2-8c94d251f5e9", "comment": "Malware payload (RedLineStealer)", "value": "7e9ddbcd5dbce6762dc0ddd0869eb6e7806b993613a5fd23b94f9da14154e9d9205596ac09cf706dd0eeade094b072d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678640, "uuid": "b3cbbf00-14e3-42b4-9192-f5c90351267a", "value": "T16294BE50BBA0D03CE1B752F47A79D768752A7EB19B2051CB22C67AEE56342D0DCB430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678640, "uuid": "ef3f12c9-523c-4d74-8add-bf8c1490835f", "value": "31aa62a1475f16bb34b4e4697da0deed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678640, "uuid": "3b12ed0e-7e6e-451e-b949-9b39f341afa1", "value": "12288:qHcN8xFndF3NcuUku/QrMLFYGmML6BeKOD:j0FdsAOLaqMeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650678640, "uuid": "230743a7-67a3-42b9-94b3-92868cc6a01f", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650678640, "uuid": "dd761217-50ee-4e1c-9766-03b8e274b240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650678640, "uuid": "4a57cf94-bc56-4cdb-91c4-aca569309681", "value": "ee819a54c2ec47e3f7756409f56703ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }