{ "Event": { "published": true, "date": "2022-03-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-26", "timestamp": 1648339382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9627f12e-936b-4c9c-9fa0-10b23cecbc76", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943b1397-acc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648272084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272084, "uuid": "2c1e51bd-0104-4d0c-aa05-2bcf093943d4", "comment": "Malware payload (Heodo)", "value": "0ee3779fa5925e82bc04a3d18f5c0a49", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272084, "uuid": "f2380469-107e-4be8-be5b-78baba77056a", "comment": "Malware payload (Heodo)", "value": "02a310a1089a11d086e01c77e58c7a453e124dff8b57c79e926e81777b04f30d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272084, "uuid": "84cfe4b9-5845-4b24-98fe-f084b3af2e1b", "comment": "Malware payload (Heodo)", "value": "ea065fe7e86f042dc2c24394f7f754c52c6e192f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272084, "uuid": "c23907ab-510b-4535-87a1-2a5e4167c895", "comment": "Malware payload (Heodo)", "value": "2eb8f6a5bdf74267ac28776407019e80d58b4a2c61f0c6996af1f70ee9ea92c24f38b83ba4ea5c01be333c32e8ba96a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272084, "uuid": "cc1ec2ad-c967-41d5-b42d-6af07cbc7733", "value": "T1BC158C316143827DE95F663AED22F7F6225FF81147B096E709042EFC89744EF4636A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272084, "uuid": "63247e7a-294e-4dbe-81e8-bd34d49c7b2f", "value": "1e8e7e5b053a6113954e3e4d9100279c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272084, "uuid": "7f5f2996-e9e9-493a-b22a-7dae44b9416b", "value": "12288:Jualogyxm2HRLaJYiNLCRACw+rGYPw+PYF7o8v+N:1ogys2iYaUGYIY8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648272084, "uuid": "7bd115b0-edde-4adf-8d69-3d3b448c71e4", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648272084, "uuid": "c0ae7c53-3f54-4441-84b5-21d2255ea5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272084, "uuid": "2f055155-41fc-4b2d-adc9-7db3fb15a31e", "value": "emotet-bonus.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649533d0-ad03-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1648299062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648299062, "uuid": "84d3b1bd-c33c-4aea-bfd6-9af29c7030f6", "comment": "Malware payload (NanoCore)", "value": "04f815eda3f6b36fa55c1b78ff3226fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648299062, "uuid": "b81c9b6d-6e3a-40e0-b0a1-ea5399a192af", "comment": "Malware payload (NanoCore)", "value": "050a2bfbc7d5e0dab19dd6cd39297badadaff7bdeaf9094ca2a6e08faee6bab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648299062, "uuid": "46c3ee02-607c-4fa3-b5b5-0568e721ed27", "comment": "Malware payload (NanoCore)", "value": "0232158497b013f83466519b4e9be83d7027698e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648299062, "uuid": "53908ce7-7b93-4b8b-a0e6-c59c199d9fb4", "comment": "Malware payload (NanoCore)", "value": "28fa72770dab7b43a34e393344923b5a2005725c3983d167017037e3abbaabc5f2762df34dd60f54cacd4535e6f6c7a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648299062, "uuid": "b29174df-91b6-4118-a0d4-c8a80fa43b92", "value": "T13BE4AE71D2F8AF9BD439533C4071841677F5D822E328DA4EBEE910D64893BC24B36B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648299062, "uuid": "95bd487a-e7a1-4095-a0b1-21d4a9cff0a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648299062, "uuid": "073403e9-06d9-453b-aa6d-0401642f205a", "value": "12288:gfUNoT0kVeo6VYbdn9wED2TDiX6gcFX2Etv2VXkPKSOsQqvW2AdDzaEo:gcNoT0kVeo6VYh9wB1NtkXIKSQqvW2Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648299062, "uuid": "f3ac9883-0111-4e89-b47b-df807a8c73cb", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648299062, "uuid": "48ae02ea-6da0-4047-b16d-ac0f064eafc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648299062, "uuid": "f4587129-e89d-44cb-90f0-1c807e9f774b", "value": "NEW ORDER 546576775643, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f3be59-acfb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648295459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648295459, "uuid": "c3821e78-5d9d-4f6f-97af-39684cd052ae", "comment": "Malware payload (RedLineStealer)", "value": "c4fea8323624a61839778476d9c3c234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648295459, "uuid": "0fe1fb40-7bbf-41fc-8526-90bc92275789", "comment": "Malware payload (RedLineStealer)", "value": "06199cb93b4a5dcf21feaf67236f9fc796b21caa7de4b0bb0dc308bfe75e1e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648295459, "uuid": "037fd6fe-4c98-4fc1-be05-24367d7fd464", "comment": "Malware payload (RedLineStealer)", "value": "82e5ebb03ee80ac147803bfb311f1a8538209089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648295459, "uuid": "bc078deb-9214-4fdc-ab0c-c5a0987f8ad5", "comment": "Malware payload (RedLineStealer)", "value": "05be5bad25e95daef3c27f2617ac94cb84b3ae053c95a7523a3e5243b8b6d9175d4ea07ce71b6df8d4914e9237a7afdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648295459, "uuid": "5c223267-1bff-4c98-bf9b-f28ed83808cc", "value": "T1F1A423662006E24DE0D8A5F3EB58DF47CBAA230B70855C5BEBDC2F49693407C7B8409E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648295459, "uuid": "17ef6172-133f-44da-8080-52fead7e548b", "value": "bb33ebb01e5d6712ef0952d04547004e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648295459, "uuid": "9fe86f74-62ff-45ec-b275-3c5732fa7dcf", "value": "12288:N5+blK/lGRgOUqmq9kR6lhKXyB3a9FsqJKB57d8fF:N2lK/cRgOnmq9g6rB36rKX69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648295459, "uuid": "93229dc4-6c6d-4708-aad7-b82500de8c71", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648295459, "uuid": "895d255d-fcea-4205-bb6d-939b83089fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648295459, "uuid": "ecf076c0-61fa-45e6-8ffd-ed95fbc3d7dd", "value": "c4fea8323624a61839778476d9c3c234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d520c5-ad1d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648310226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310226, "uuid": "503026fc-c5be-4223-97ba-00302cbc49ed", "comment": "Malware payload (RedLineStealer)", "value": "5c7daf503bd0ef5479a277e21784a5a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310226, "uuid": "9f48b664-d24b-4ef9-9b43-59060e226c4e", "comment": "Malware payload (RedLineStealer)", "value": "0a90734617954138c041ac5ba7956064478b5dbcdf622ec2ed0e619f044c74f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310226, "uuid": "ef4f93b6-b600-4254-90dd-aee1188a19ec", "comment": "Malware payload (RedLineStealer)", "value": "38d655bc6e05a4333cbc3d7676fe9670228df70f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310226, "uuid": "c9b8b50c-382f-467b-ad71-4dc0c6921f66", "comment": "Malware payload (RedLineStealer)", "value": "c9c7440200eee5d710918fffc7dd27e27fcbe19b72a4057cd14571848469c851f5815f3501fca279784c809857c0f61a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310226, "uuid": "be4398b1-449a-4a18-8d7c-64328bcb2c58", "value": "T1B58402327B81E031C45362363C89DA716F7AA8350A2A5D4BFBF61A2F5F603D161F9706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310226, "uuid": "98acdf8b-29eb-4234-855b-55143b18863a", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310226, "uuid": "a0591bdc-930e-4e21-99f1-b0a7b0bd464b", "value": "3072:7vKa1IdxI9jNLzEuGzWxVVymsaWAk99G9rRKZj5WapogHWcnBXwUFkC6sTETI3VG:bGdxIXEsomvWAkO91yJpogXbeCPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310226, "uuid": "55a76226-d52c-4ccd-bc3a-44cb15bf9b2e", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310226, "uuid": "c205fea5-a6d1-4d79-8f4a-48a85ed5890e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310226, "uuid": "3a9e397c-5736-4280-bddf-630e1ef7827e", "value": "5c7daf503bd0ef5479a277e21784a5a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c990550-acca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648274514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648274514, "uuid": "a19f9afa-a424-4a8c-894a-61f2be3a6101", "comment": "Malware payload (Heodo)", "value": "ea10dd3e579b6371f263863b2e3086ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648274514, "uuid": "777a6218-0648-4a2e-ac1d-95b03a415c51", "comment": "Malware payload (Heodo)", "value": "0b7bca3b8ca150415a0c2ebb498dc705ebdfbc4515b673e94bafee1734597b4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648274514, "uuid": "52f791e3-54e8-4c74-b861-9a0111b9d74d", "comment": "Malware payload (Heodo)", "value": "d1cf8b8945f45b96d440efbc20e9a4c963985d98", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648274514, "uuid": "cee3214d-3053-4292-8582-4a2349c3718b", "comment": "Malware payload (Heodo)", "value": "fa2cf8b711c24596d643f6a65d196da23a80d1a2d88b95e687066801a023a89aac52556d6afd6488bf52a879882e9528", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648274514, "uuid": "ee6dd360-d9a0-4567-8433-23ca07424647", "value": "T191F428137DC34030D8AE0875852AF24669A9EF04EBA9B33EEBB57D8D24315974D34B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648274514, "uuid": "cea3c6c3-df74-4831-a291-7a1ada0fb31a", "value": "6144:eiH1vXSjOsl8UG2fde2VwS7D8dwDFYAcAf6UZUfNKLgM1xIhg3teXE3XsuTWKi7u:x14GEdtVlnqYF0ArZUQgM1xou/iAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648274514, "uuid": "19ae449e-6346-4e9a-b622-3f444d785bfa", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648274514, "uuid": "d7508633-dd8d-4d72-9da5-419b934f682e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648274514, "uuid": "c1fd9fa8-ac83-4a75-bbd2-4702ca415bfd", "value": "emotet_exe_e5_4473c27210a4fa17562c850c5cbaf2f5428a52105c9d9bb27cc5481ce3148147_2022-03-26__060147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fdeabc-ad48-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648328914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648328914, "uuid": "7f6f0f20-049e-4957-878e-c3090cbc2422", "comment": "Malware payload", "value": "7de76e6ce193454ccb28a1194427fbf4", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648328914, "uuid": "612ab796-a331-40f5-b3f9-955a8b84074a", "comment": "Malware payload", "value": "0b80b497370f99697e74c7cef81ef4ba42a436ff52e6a5af031a8e615a937555", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648328914, "uuid": "38cd43f3-4958-4dde-8cac-008b2ddd3437", "comment": "Malware payload", "value": "24040fb934e6a946ee45499a2f4577408a589515", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648328914, "uuid": "d7766036-4c99-4b6e-b183-012c34ec52c4", "comment": "Malware payload", "value": "3dfc471a531a7ec5167c46bb15221a6eca5af8b71767bf3650fcc81d92caf7464b765a612176a8546f29f47945a6d59b", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648328914, "uuid": "b135ef23-99cc-43b0-9d8f-b7a9a0f3b3d2", "value": "T1A5447C46FE8365BEC9A75971047FE23EEA3149184113CDB7EBE99E34EA2FB101D18205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648328914, "uuid": "94530589-607b-4ef9-b740-13b82397f900", "value": "8f26049320de16bfea841c3ee62e6cf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648328914, "uuid": "37684ddb-0966-4bc2-9985-0dc08f062b3f", "value": "6144:eLkFD65xYTeNxAqpRI27Hyii9FxWFkMFBfjSdhT:ckw5iaGqpRI221WFkq1WdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648328914, "uuid": "1bb15e55-e204-47ca-9a1c-a9d31b8bc25f", "value": 253966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648328914, "uuid": "24f53c88-b247-4c09-a0b2-18d58b741613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648328914, "uuid": "75877456-1650-441f-8489-74fab67858f3", "value": "0b80b497370f99697e74c7cef81ef4ba42a436ff52e6a5af031a8e615a937555.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac99aee0-accf-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648276849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276849, "uuid": "18179cb7-6937-4b1e-94ee-267f413c85dc", "comment": "Malware payload (SnakeKeylogger)", "value": "dff9d2ea53508ff5dc5cb196cdb472a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276849, "uuid": "03c48b1d-e99a-42bd-a31c-bda68706ce85", "comment": "Malware payload (SnakeKeylogger)", "value": "0dd91b7745c258acac6981754f3cf38b20b2f531b5978e98f7fb1928a0d1f0dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276849, "uuid": "79711570-aef3-4973-89c2-959159491de3", "comment": "Malware payload (SnakeKeylogger)", "value": "0c85647a1d8640e5a96128669169eee194477f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276849, "uuid": "c0617133-6269-4d56-b6e8-cffb9dc40165", "comment": "Malware payload (SnakeKeylogger)", "value": "a3cf1769a62e0cec558cfa6265e33179bfbada5c8a6654d4bc07f960d7f71de0eb92aed662d4eb547cbe49b1f8d660a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276849, "uuid": "1d6b198c-cc9e-452a-ae4e-e454db8fe92b", "value": "T136431883E2C48311E8244970693B5E381736BF89EE42750A31DCF51B5FF77C6A92286B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276849, "uuid": "b80d3982-1b74-40d0-b57b-b7f7e8867ffc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276849, "uuid": "b92bce46-e26e-4a44-9f79-74832697db2e", "value": "768:kjmvwgQxiK56WHCfUHQwP0Z//amaOgqxsCsoKZo76:XvRK5Vh0FaOgys1jZo76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276849, "uuid": "7fd65fc6-43b6-4b3f-9c04-8759cb90989f", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276849, "uuid": "dfe193a6-5e28-435a-a55f-7d5b53e2c9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276849, "uuid": "fcebc179-1a90-4104-b98d-f06be87af36a", "value": "2BBA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b24463d-acd6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648279773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279773, "uuid": "12475749-a875-42d2-bf1d-023afed789f4", "comment": "Malware payload (RedLineStealer)", "value": "2800ae5002eee8888506d8bdd5e98d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279773, "uuid": "9e24ef93-a17a-43e2-987d-14574b22aee6", "comment": "Malware payload (RedLineStealer)", "value": "1060062843db094565146e1a4c123b73e4705d23fa4c72050733d6013680c3ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279773, "uuid": "05f47a16-d690-4b85-b3d2-842a93fc0ae2", "comment": "Malware payload (RedLineStealer)", "value": "ec48fbce71638f20ba7095460952d1160625e8f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279773, "uuid": "bbdcdf41-02cc-43aa-93a2-071102cc5334", "comment": "Malware payload (RedLineStealer)", "value": "0ca9e441a2973c029b6a6d5ca090e5a145a0995ffb635417070e250aa0b2a20eace967d90630441d0da2c779dfaebc49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279773, "uuid": "db23428d-8a0a-4b62-8787-f34627161099", "value": "T1A9D4331F834DBE18D64F4BB665187CADEAB050427CE1F167A1AB9806EC5B023FD6C11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279773, "uuid": "7dce1b44-39b2-4afb-a45d-89ffbafaabe3", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279773, "uuid": "a4f6409b-c1c3-4e93-ac66-21d26c91a380", "value": "12288:8A5XYaBG1Aen//3MEL9as0XuP9MQS03ULaHNqrxlKIQNodeU1aVxzcpjX:lyaI1ZMUGO9MkEaHNYK35Usf4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648279773, "uuid": "920f039e-7465-4ea6-888e-30890cf67dc3", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648279773, "uuid": "feeef229-5ef5-43df-b644-3fe7a28e5e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279773, "uuid": "4bd78a6a-354b-4216-b3b6-62325e6ada0b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333c0f3a-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648310576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310576, "uuid": "583484fd-2daf-4eb4-a1a3-dacec05c23b1", "comment": "Malware payload (Smoke Loader)", "value": "a4e9d68a3d54a2fa07bdb296aaf14d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310576, "uuid": "1df7ace7-d0a2-4d94-b79e-cf1366ebebbb", "comment": "Malware payload (Smoke Loader)", "value": "10b720b3e88249833192b82d80df7fd4fb9cdfa75e01f812925caafea6e7c2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310576, "uuid": "3d081978-3c14-435a-abc4-277fff2f1599", "comment": "Malware payload (Smoke Loader)", "value": "052f4f96dad52e60bc4eda758f371f8658eb5ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310576, "uuid": "923b2840-22bf-493e-bc85-4ad4f0450eaa", "comment": "Malware payload (Smoke Loader)", "value": "884a464ac146608f60eba21f6b610f35d0f87e527c410fddcb173e34b2ef8d322eaf6c08afd9d7553edc2ad1b7825bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310576, "uuid": "95272bb0-fe58-4196-a9c5-bad7c64a66db", "value": "T1F124CF223691C032C44B1536B475DAB55A7AB83607514A8B37590B7EAF303E293FB78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310576, "uuid": "83e1142f-9d14-4e69-b8db-1b0ca1a1e976", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310576, "uuid": "ec5064ce-8200-437a-96fd-6f4064537bc2", "value": "1536:pj2KdoUG4TVbdAGkDrQar00Oim7K5qYYK45DOeHsg12pwZ945ArW9Pza:x2KdojmnC1YK4ZjMgkwZy5w2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310576, "uuid": "2eafd4e1-e73b-4ff2-9a95-5801eac37509", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310576, "uuid": "0394c753-aa83-42f2-a993-408041bb99f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310576, "uuid": "37abf564-c04b-40a0-bf69-18830d0c99da", "value": "a4e9d68a3d54a2fa07bdb296aaf14d05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74172776-ac9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648253991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648253991, "uuid": "e332a64a-4092-4147-b4c2-dbbd491ad783", "comment": "Malware payload (Heodo)", "value": "be65194377bb873144c1916fdc0989c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648253991, "uuid": "4e4854c4-98f0-499a-90a3-8c0970e4cfb2", "comment": "Malware payload (Heodo)", "value": "11e93458c1e7e602af8053f7f0404ffd6744791ae723e5b458fdca92b93f104a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648253991, "uuid": "939c7a42-0be5-4820-91be-db77e78aca95", "comment": "Malware payload (Heodo)", "value": "0e9be0f1d91f1f121a65630fbb18a0cc0843e8d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648253991, "uuid": "f454df9c-862b-41ff-9da4-cd4c2fc7a83e", "comment": "Malware payload (Heodo)", "value": "40166b18775fed9842eb99db669ff97a0181628857240824da2cee7c4a1df98af50583f311dfd2f3e7e731daa78a80fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648253991, "uuid": "983393ca-ace6-43e2-a44a-7e144df74e92", "value": "T170D46C117691C832FC995F34359396BD1FF97F64AAA8822BEF803A4D6BB35008D142D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648253991, "uuid": "da080b80-fc5b-4200-a819-d6a5df267202", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648253991, "uuid": "222a1f82-b7fe-4054-aa20-ac62d4a859ec", "value": "12288:bGptged525pthqnh0+RUKyTpoOvHuf27x+x:Ch525Dhqnh7mpvOf27g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648253991, "uuid": "ff989415-f833-4046-80a6-2f668dbd94c2", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648253991, "uuid": "b0a7fecf-1b7d-46e7-89e2-38ed660e99d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648253991, "uuid": "e63f627b-ea15-4d08-9702-8431e3880d80", "value": "emotet_exe_e5_11e93458c1e7e602af8053f7f0404ffd6744791ae723e5b458fdca92b93f104a_2022-03-26__001946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80356bf3-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1648277204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277204, "uuid": "fe0890ac-5d08-4581-a37a-35a0dc8cb119", "comment": "Malware payload (CoinMiner)", "value": "7996d936922b9985fa9d59918bc0d49f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277204, "uuid": "1f493648-bea4-4d0e-a2e7-387291fab95e", "comment": "Malware payload (CoinMiner)", "value": "124d28003022f917ac0a18508f315d69083883ae2090c0651fa6e7c171f9e019", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277204, "uuid": "c5d12169-9056-4a92-b900-7dc3c8fb8cbd", "comment": "Malware payload (CoinMiner)", "value": "06b7a250e548a9093b5bd6cbd2b0d5799cbd1bc3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277204, "uuid": "98b6bddf-7adf-427a-9cf3-a6d4ddc8ad85", "comment": "Malware payload (CoinMiner)", "value": "086acdc1c560b810d5cb7315c2b7249a8d76f67ce4ea6b8e92ec3e1776688d7ea64be42b683ffbe4f89ed8449f8b58a0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277204, "uuid": "7a3126f8-c00d-4c8a-a5c6-ee701b379c69", "value": "T114B18DB7D2719CF2F255F2BA968ACE6CB914133D17EDDC803D1D00712E522387A99276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277204, "uuid": "d5c27c7b-86ef-4cf3-b961-3d2d4c543b62", "value": "96:eP0VL+2QBy6yyIKbT7QlbrQ+1936D9kG9WhlkVoGsQ8QinUdeb2R+3D:eP2+XvIKbTCfQ+TK6zkjsQ8QWxb5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277204, "uuid": "a184ac8c-6224-483d-acc7-174fceb11eee", "value": 5225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277204, "uuid": "b2beee02-6d56-4ade-bb1b-fdefad6f93b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277204, "uuid": "eb3b9389-ca52-4839-be32-7e1a63179429", "value": "7996d936922b9985fa9d59918bc0d49f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f642fdeb-ad54-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648334096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648334096, "uuid": "2f11c504-9c4a-4215-90c4-e92a5147df16", "comment": "Malware payload (Heodo)", "value": "ff30a6c9f80854c3276e9bb43b083f23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648334096, "uuid": "6fd9b5e8-a79e-4ec3-adc3-c25500ace226", "comment": "Malware payload (Heodo)", "value": "12b388da65f9c204a41abd442f0f270713791e7bbb9321c70ed988f048d72f33", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648334096, "uuid": "206d8f9f-ccca-489f-a36e-48bc998a20ba", "comment": "Malware payload (Heodo)", "value": "c8ec298eb5cafb60f6d0535ff0680baad46d332b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648334096, "uuid": "776a58df-2b63-4618-85f8-cebe3256d881", "comment": "Malware payload (Heodo)", "value": "b5fcb5aeb0255fabb9f5315bc34d6cd81b7188ae57d716aa34370354209302a1ca186191167ae856d5deda4ffd29def7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648334096, "uuid": "ef847390-74d3-4887-8910-19640aebc742", "value": "T100F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648334096, "uuid": "3e959a13-f65b-4973-afb0-9ce4b6b2c3fb", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648334096, "uuid": "40b9354a-bfd0-4174-8c6b-e30251f6a623", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPkXvkgKtuBdfMAofD:WCBAdKV9Xf0kb3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648334096, "uuid": "f95dc911-3156-499c-a62d-44d3fdd612b6", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648334096, "uuid": "9148b350-cd0c-4e0d-9b5c-f6733602f5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648334096, "uuid": "5d5e400c-93da-47b9-8fa0-d9c42e29e6ef", "value": "emotet_exe_e4_12b388da65f9c204a41abd442f0f270713791e7bbb9321c70ed988f048d72f33_2022-03-26__223449.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d4c0a3-ad1f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648311142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311142, "uuid": "0facbd1c-29db-425b-80d5-01950ddfb0fd", "comment": "Malware payload", "value": "d29fc9a23fb71a036c96d483d07efb78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311142, "uuid": "c31f718c-7841-4d8a-964e-6e9608ae6f4e", "comment": "Malware payload", "value": "1485291e44d2b87662fbae21f8e3afc966958b2a135d8bbdd1f9cf2793bff5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311142, "uuid": "1d006ca8-e452-4308-bbff-47d1149852c4", "comment": "Malware payload", "value": "2d18efa312ee375137b7de6d11bac5da92931424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311142, "uuid": "b4f0a3c7-d428-490c-bec1-bb829ff7d5dd", "comment": "Malware payload", "value": "9e410e23a8596687618ac2939f1ab4c11203e5e0e183ce792a0fb5221688f281368c836958b93e37f301bfb8d385d351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311142, "uuid": "df1e2f03-7e92-4ecf-80df-c7c2a49593fd", "value": "T1B0D53342B0399E60C4DEBEFE5E0601E8E6361CEEA662A5DD3B102CDF837B105941D7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311142, "uuid": "be8750b3-b682-4946-a063-f6cb3c86488f", "value": "3bb8a6893e884c662aa888ad252a201d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311142, "uuid": "d3a7842e-815c-4569-9568-c6f06cdd20d5", "value": "49152:eBvzkNnPS3MW/yYWqJSsJrUZFoC0OKYXpLP3kcpVj4HfUUewZ/LXUv4mUN0lOIa+:5NnAMWh1JSsp0oC0kZL8AUewZ/baRwad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648311142, "uuid": "daf6cdee-9729-45fd-bcbd-c0d31e5f471a", "value": 2774153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648311142, "uuid": "4e89b5df-8cf7-4356-9998-da8306070e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311142, "uuid": "618c212a-0f8c-4e57-b249-2eca36e63bc8", "value": "d29fc9a23fb71a036c96d483d07efb78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee248a8-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648277175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277175, "uuid": "0e035090-61f8-4fdc-859e-ab6fb9730a13", "comment": "Malware payload (RedLineStealer)", "value": "5f337811373b8c7d6e1f7a39e6fee4e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277175, "uuid": "d6f11795-a7d8-40b3-b907-cf50e7f218fd", "comment": "Malware payload (RedLineStealer)", "value": "154cc394fe2821baa5ef4f7efa160e181a70f689a0d3ab0ca40577cba2edefbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277175, "uuid": "37289138-d0ea-4541-a623-b3302663a275", "comment": "Malware payload (RedLineStealer)", "value": "28dade94102280f3f32c07e304af045b7dd7488a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277175, "uuid": "295a2159-ce21-4c1d-8289-018c9938ac18", "comment": "Malware payload (RedLineStealer)", "value": "18447ee714b85676701ceb1eb5d79c09f15eccbfa888520f16028a916143bf5c2154b2c3681f597eaf15f11ab0d7259a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277175, "uuid": "ef368e95-6f84-4d18-8808-886185576f31", "value": "T12AD4238AC3C0A55EC25F7EB899FA392A5434D119F0E490F3E67A6A4356F00BDF7E8114", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277175, "uuid": "718549ff-0609-4892-bc84-882c24216cc0", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277175, "uuid": "53b68049-981d-4d26-abda-a95c245cdc8c", "value": "12288:UIvwlaBvPWCrhQHuewU5XiLg3tQS03ULaHNqrxlKIQNotydnt/p3hzyG:dI0ACrhQEU5XiwkEaHNYK3PZtxNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277175, "uuid": "6af60e8c-5273-4f32-97b6-a9a38b50f18e", "value": 608048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277175, "uuid": "7965cb35-bbc8-4d85-b0a7-9b2561fd81b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277175, "uuid": "428b0b85-aa9b-4d67-ab1c-3266cfa378c0", "value": "Ngame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f34285a-ad40-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1648325172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648325172, "uuid": "7b0780b6-6225-442d-86ad-b93a3f2ef9d7", "comment": "Malware payload (DanaBot)", "value": "c6126a4aa5a4643eaadd0f4a6c2b06f9", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648325172, "uuid": "d3be6e2c-46df-462d-b36b-ca025c0fc1c7", "comment": "Malware payload (DanaBot)", "value": "157757f5065076824ea142b1e3910b51326149a0a457f986cc4270b5fec1d319", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648325172, "uuid": "6a07f5e9-e48e-486a-a055-53bd53989551", "comment": "Malware payload (DanaBot)", "value": "fdf12fc5aa0e38dc5b539b1291f04fe1a30985f6", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648325172, "uuid": "efe0975e-6b75-4d1b-b1bc-7163316c89a6", "comment": "Malware payload (DanaBot)", "value": "20c450bd5e3cd0702b438b606b4928f71db96da0d9db29ce94f12cacde76b5c57e8a549e0966772a053df9f98c5fa856", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648325172, "uuid": "50be6891-5981-4f1f-bfb0-cb59d95de2bf", "value": "T10735230170A1D472D096BD76E4A4FE34D3E9C87142A9E1DB2304627EBF207D2567E29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648325172, "uuid": "bd7d3f9f-65cd-4e18-ae90-09e6b974d7b3", "value": "db9d63801b52e5f18d5dc80c5fed99ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648325172, "uuid": "45d3bf4e-29f0-4c20-b50d-088fda6f5b22", "value": "12288:43vqr/B17jAPeQp37W9nsLx3EXWcUoHM00znmPJcWZTziS5Zugfz3xaCXBKQp6:yvqrPjALp2sdyNUCM0yGPZuEZugbWQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648325172, "uuid": "73b9e955-bb3a-4ab7-a18a-2cd7edce408c", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648325172, "uuid": "77807f6c-1d4d-4179-9822-9c5747c82a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648325172, "uuid": "b79f862a-26cf-4729-a8e4-e0f95e935603", "value": "157757f5065076824ea142b1e3910b51326149a0a457f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dc7feb-ad12-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648305565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305565, "uuid": "0de7a679-80d0-4812-914a-0332fc0c2c9b", "comment": "Malware payload (RedLineStealer)", "value": "8a9a1be6f5d627ca13e9cbedffc9f10f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305565, "uuid": "cb78b0fa-1bfd-4337-9ed3-8d9d22b4bce8", "comment": "Malware payload (RedLineStealer)", "value": "183f8e91fcebc67e54c49ea0f85bf6c01e55291e212ae82caab5b76ae5d3f811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305565, "uuid": "d7fc6310-05bd-486b-954e-cf2bc967ef81", "comment": "Malware payload (RedLineStealer)", "value": "70c444f1c8046a460c5ca087de6af9247cfbf7af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305565, "uuid": "ccba4217-41c8-4751-a451-71560b32b1ad", "comment": "Malware payload (RedLineStealer)", "value": "7a65bf1681b7185d3d8359891b2a74a0b3581bdc4e3ec13f344fc1f3700bd13a6ae4cfc06e18f06f88d15ab5583c7861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305565, "uuid": "09174946-dce4-400b-bca8-d1fa8b0caa57", "value": "T18CD4233700646DA1C24B59F24F5BAE96D35F5D6CEEECB29BA27D7B843048062E70B170", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305565, "uuid": "411d4630-5e8b-408d-8b08-ce3159f2cbd9", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305565, "uuid": "a8bce360-621b-4619-92d2-6b5dfc00b9e8", "value": "12288:s8Cr8M7DdTlLHo++66ln+LTzvKxQS03ULaHNqrxlKIQNoGV2TDxLvdo:s8OrLIuU+LTzCxkEaHNYK3p4TDNvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648305565, "uuid": "ff044c45-7ba3-4548-bc4b-f4ff1bd1c331", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648305565, "uuid": "06765819-ac28-47df-9f8b-519fa27980b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305565, "uuid": "2f60c04f-4c78-461d-8910-b85a0336719e", "value": "AbletonLive11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbd73ad-ac9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648255057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255057, "uuid": "a40f2b75-3bea-4c0b-aa20-c3affec21c45", "comment": "Malware payload (Heodo)", "value": "e7ede6929e0b757c9f6428fbf31596cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255057, "uuid": "5e63c0dc-0abf-4bd0-bca9-643a8f1f88d6", "comment": "Malware payload (Heodo)", "value": "19a26984c3abb9b43ac3284873b1cb3b9da8f789ecfeffcba5a25a01c588c5de", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255057, "uuid": "87c714c5-8351-4280-9474-71a661e97b39", "comment": "Malware payload (Heodo)", "value": "50b4f13f750698b4944568881c1c1750f4cd992c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255057, "uuid": "3aca4700-415c-40b8-8bb5-051eba6bbb07", "comment": "Malware payload (Heodo)", "value": "f6ace67f01dab405ddafcfba538953fbc9fc31781e5c944144a7e6c1cecbdc6e4e5a4191cf06ec4076ebf4fc65bacc3f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255057, "uuid": "be6c91f8-84d7-4971-9adf-a27e5ca12753", "value": "T15174F81233C390F0C653B574840FD525AC76B83C6B15897DA24BA66F87E78D0DA34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255057, "uuid": "542a7a3c-e6eb-4c32-bca4-a9e94cd42c0e", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhA:S54yM33d3q3Z7BogA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648255057, "uuid": "6cffeaeb-a66b-4fc7-ae7c-a434a5e53a1f", "value": 342624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648255057, "uuid": "9fd4249d-4eed-476d-bcd5-89a17fdd61b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255057, "uuid": "6ce527a7-351a-4f42-b2b9-8ada0f2e9c13", "value": "emotet_exe_e5_19a26984c3abb9b43ac3284873b1cb3b9da8f789ecfeffcba5a25a01c588c5de_2022-03-26__003733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be87808c-ad1d-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1648310380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310380, "uuid": "5ff46936-0bcb-4f10-85f4-4a216c8f95c7", "comment": "Malware payload (ArkeiStealer)", "value": "768cea2ba376a25d1b257fc387b18b44", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310380, "uuid": "0dde42ad-9077-42fb-9c7e-6740e3fd3ed5", "comment": "Malware payload (ArkeiStealer)", "value": "1cb539ae172b68b6116f7017b12a666b3e4fdb86130b10efff77c313696a02c4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310380, "uuid": "28642532-6837-4091-af31-2804a2eeb7dd", "comment": "Malware payload (ArkeiStealer)", "value": "615f20b076ae1eedf261f787f1ad9ee5de3c22dc", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310380, "uuid": "bdd104c0-1f7a-4e68-ba55-d091fdf50727", "comment": "Malware payload (ArkeiStealer)", "value": "4d68c72ebb64cb954fd723b044682fda4e037ad561c6c300b88109677b983d7c840a22f7758cb6c39ae4590df9a627fb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310380, "uuid": "51bdb96e-87ed-4b26-ba00-cafb8cf8563b", "value": "T1D944F1127B40C832C00398393765C2A0A67ED53107A797577AAB466F5F613D2BBF970B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310380, "uuid": "2c055ae2-2565-44e5-a551-66396cbc2a6f", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310380, "uuid": "baaef7c7-2635-4f31-8278-fad04b33d720", "value": "3072:OsKwyFGOjBfvmRGEmRsGtgGqBXtdi6305UKvw:T04iBGRGXOGqkUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310380, "uuid": "06453049-a37e-48b1-a0a2-e06f4edd2034", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310380, "uuid": "ccb7834d-9601-4a20-a258-153cf8c1e1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310380, "uuid": "3b414df2-2b31-44e0-b80d-a5560e32ed0c", "value": "768cea2ba376a25d1b257fc387b18b44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1d7b4d-ad5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hive)", "timestamp": 1648336552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336552, "uuid": "235c351e-e98d-40a6-9a7a-651cc3ca4751", "comment": "Malware payload (Hive)", "value": "f2bc24e3e26f9b262cff301acebb63cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336552, "uuid": "3b022563-1d7d-44b6-84bf-bfbfbf4ab2d6", "comment": "Malware payload (Hive)", "value": "1da2ac26e7276121d27947007be6056c33cec55b7a3efcd555b6a91506769d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336552, "uuid": "06b22333-8dc1-4db9-9566-3d84cd27ee5f", "comment": "Malware payload (Hive)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336552, "uuid": "2acd3e01-0e07-45d9-9b74-fb491d2e1b5a", "comment": "Malware payload (Hive)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648336552, "uuid": "1575693c-4319-45fa-966a-d89f49fb0246", "value": 2746880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648336552, "uuid": "52c9fcf1-e5ec-4944-af79-90b2ca23b78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648336552, "uuid": "bdeb5391-f61f-40cd-8df3-0045bdb58abe", "value": "f2bc24e3e26f9b262cff301acebb63cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e48c79-accf-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648276856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276856, "uuid": "8bd40ca8-caa8-45b6-8e3e-5e648f23adf6", "comment": "Malware payload (SnakeKeylogger)", "value": "9c965c3ca19c92ea7dc633cf65ca2895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276856, "uuid": "6e590cbb-ac88-4272-8870-912bda841f51", "comment": "Malware payload (SnakeKeylogger)", "value": "1e7bf321ecf78820f9422ad944e55288c5dbf0787ddafd97120791a0dbbce80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276856, "uuid": "5b698d5d-ed8d-4565-8feb-7b2da4098a4c", "comment": "Malware payload (SnakeKeylogger)", "value": "35814e6aa22cb33884987a021aed2736fe308a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276856, "uuid": "b493e1a7-b56e-4ad7-ba7e-b80dd60e1b1f", "comment": "Malware payload (SnakeKeylogger)", "value": "4d91e6272d235f19ca1e98feab7fdad14cf9312948020d270672dd0718ddb3bd570d55400120e038ff505799e9f32194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276856, "uuid": "e15a45a1-e2ee-4430-9814-2584ff487c55", "value": "T1E32502051D818E0FC7B50AF80CA1648CEBB5EA1A153999E9FF9C31274B3579C1BF3698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276856, "uuid": "9dc4c7fd-2fb1-47fa-91a4-5d9795470c2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276856, "uuid": "79584bc5-1b3f-4640-b020-72521d6fe773", "value": "24576:HsIo7nYQNN+5JfTkLvRkjbgfLVAd7joBBlVofHH:H87Yz5JfTWRkfgjVAd7glVofHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276856, "uuid": "42b3285e-b688-4ff7-9567-bbf43cdd34f5", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276856, "uuid": "e5a27a44-64b6-4251-98d2-2e88ffb3e96b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276856, "uuid": "f1c8056c-d63a-48f9-9b0c-2b3f35545e46", "value": "SWIFT MT103_89,000USD.PDF(101KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bdee97-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648310627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310627, "uuid": "97e0e89c-6eee-4616-b83c-94ef34e0d086", "comment": "Malware payload", "value": "074430999ad587fc543e8fd2da0bc3da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310627, "uuid": "c2ea1edc-aca9-445a-8dd4-3bc5b320478a", "comment": "Malware payload", "value": "1f6119a23945c69994b636efc5c22f425cf214b043c8aeb30f0d8e1753cc3079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310627, "uuid": "d14850aa-6df2-4f8b-842f-e1eda304db30", "comment": "Malware payload", "value": "8cc5d12773c815d2614956b6c576da4a224a90e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310627, "uuid": "996ea8b7-0bf6-4f68-8140-c95b1c85b7ac", "comment": "Malware payload", "value": "ccfac4999ffb396b9e392cb3364cbd8dcc2fe068bb6c5d28b86652a15dbadf0d286d79bfb865ceb5a6f1663d348f5b04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310627, "uuid": "bccbc348-cc2b-402d-bb1d-d1db6ae8dbfd", "value": "T1AAF53362F4365C60C0ADBAFD6E0622F4E2662DAE6391F5DD2F041C9EC373246941D3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310627, "uuid": "4260afd2-92fc-4928-bdbe-107159028291", "value": "3bb8a6893e884c662aa888ad252a201d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310627, "uuid": "b7ca9741-e16c-45ae-ac5f-07a8687bbac7", "value": "98304:5NnAMWh1JSsp0oC0kZL8AUewZ/baRwanCxoSERgUEO:5Nn0h+sp0v0k5bp62RwanCxjUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310627, "uuid": "e39c2e15-f701-4f8b-935b-7ff89fa04772", "value": 3618073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310627, "uuid": "0ef01ad5-a491-4008-b7b0-077c3a87fb77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310627, "uuid": "6011cef3-cb57-4598-8e4b-66537ef59465", "value": "074430999ad587fc543e8fd2da0bc3da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e458846-ace7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648286918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648286918, "uuid": "784ff99f-74fa-49a9-9a3d-63338cc0ac56", "comment": "Malware payload (Heodo)", "value": "071746b0384960f6a98c5961632079eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648286918, "uuid": "e2d4ede2-e09e-4425-b8e1-538e67305efa", "comment": "Malware payload (Heodo)", "value": "216d3c9a57677da9125785f23f8ec67abc3ed89de6553972a26e111178cb3d55", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648286918, "uuid": "f16bdafc-6fd9-499b-a7a6-3ecb103d9095", "comment": "Malware payload (Heodo)", "value": "4ced6d367c36d340c169f52afc2e37f3747d2b43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648286918, "uuid": "f2258044-5c0d-4a96-b466-ea4ebeaee627", "comment": "Malware payload (Heodo)", "value": "0f405181c59e431a0b0d370f33d1e669c4622be79fdf23b0b0dd1914fe998b266724457b333ace5d8201a1c5d608075d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648286918, "uuid": "fe041712-ac7e-44ba-8563-6ce92e14c729", "value": "T166D45B9BFFC2C0A3E217027986998004725BDE39B71695FF37D47B0E89383D1A635A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648286918, "uuid": "06aea1b1-2285-4f55-a925-b59316a6eda0", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqJJjO69cI:w5baP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648286918, "uuid": "3b8caa47-4967-4619-9053-4f1a0cf4eb07", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648286918, "uuid": "9bb44818-3f7b-48e6-9def-bb317bd20778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648286918, "uuid": "301c0afc-f609-4fdb-86bc-c0fb3061741d", "value": "emotet_exe_e4_a37136f14237b5b64cba36b619b995606ebc14992d0df67898603dc21403bd20_2022-03-26__092834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49304ece-ad2c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648316625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316625, "uuid": "4588519f-6537-4eda-b9cd-c4adb488af1a", "comment": "Malware payload", "value": "5b04aee3678011c4730f0105dcdb7c40", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316625, "uuid": "d9062027-5a41-4d23-ab7d-8b8ffd7e7d9c", "comment": "Malware payload", "value": "21dc67564be2973574661b80632bec32e5d4a2e9bf79e736d7f89a48cb58998a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316625, "uuid": "aa9dabab-d61f-4103-9499-f512f6c5b886", "comment": "Malware payload", "value": "641bfc87173c58eba7be82a0137c16821c6c3013", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316625, "uuid": "4381bcf6-9674-4d16-a476-b70b1df02ec5", "comment": "Malware payload", "value": "2c01933474fd47df50a61e3b4091a822604b0be811daaa9497ef3a63d4e2dac8df9c182c4b4f403f3717f463ea11028c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316625, "uuid": "4e70ea0b-7d69-4dea-9fe2-06e3a6598347", "value": "T1F4A47B507B81C0BAC31E31B1491B937A62E9A5749F3897C7BBD45B3F6FB80C19938219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316625, "uuid": "163ee920-a6a5-408a-bab4-7f050292a1fb", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316625, "uuid": "592092d3-d079-4061-ae8d-5b396f7a5b79", "value": "6144:JzyKSPnEifm5GB/bl6xlWhWYxPS3aRXysKu0kBwFIybjx6wN3UKGv0XnbexDM/+k:JzpSPnEifD6xu1XRiTFIy30ZKm0XnsDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648316625, "uuid": "710bcda3-c86d-4f8c-bb8e-82b412e7d3e6", "value": 458312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648316625, "uuid": "2c5b509a-75cc-4ca7-8dc7-67ee585bf8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316625, "uuid": "1ac32611-a1ad-4f08-92ee-86617667e1fd", "value": "emotet_exe_e5_21dc67564be2973574661b80632bec32e5d4a2e9bf79e736d7f89a48cb58998a_2022-03-26__174340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a742c8-ad14-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648306546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648306546, "uuid": "d7213210-83b3-428d-97c2-f9a24ebbf359", "comment": "Malware payload (RedLineStealer)", "value": "2553bcd081d54522a9f4b13d07c7e108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648306546, "uuid": "03b52e4c-865c-4d08-8fe3-c3373b174085", "comment": "Malware payload (RedLineStealer)", "value": "21e24220aa645b202184b2b6c637daffb1ebf14ade9a24d5de09b0e342fad6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648306546, "uuid": "4d37a1ed-b2e4-4b8d-b892-b70296147c55", "comment": "Malware payload (RedLineStealer)", "value": "aa1b69fafbc4d2c59ce2cf4837683ecd2fce08f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648306546, "uuid": "79e8d1f9-4800-46fa-9a14-781c2646fcf6", "comment": "Malware payload (RedLineStealer)", "value": "19d8a7cd7ffdf00ad97b9964ebd8ce43b0c38dfd15cadcf24ba68fb55da9a9c0c277aa3bd03ff89198eb38c30a1779e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648306546, "uuid": "78836776-6908-4efb-a5ae-735cb181950f", "value": "T16E24C0223690D032C04B16327425DFB46ABEA83557B2494B3FA90ABE5F303D156F6F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648306546, "uuid": "3bce089f-8c58-4cb5-9b7b-c63a633da9b4", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648306546, "uuid": "48719129-8414-428e-855e-011bdafcd057", "value": "1536:OOKT2jztTQudAGkD32Vrz0OwivqqqqLgY7fCXSXyXgjBFva453U9kzY:OOKT2asNvqqqqLHcKg+Fr53U9kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648306546, "uuid": "db0eda2d-7372-437e-8cd3-32370dfd046a", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648306546, "uuid": "aa925a0c-94ed-4a1c-83e3-bacb7787260a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648306546, "uuid": "47fd595b-dfb8-4f6b-85f6-b390018fd0b4", "value": "2553bcd081d54522a9f4b13d07c7e108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d009c1-acd1-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1648277688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277688, "uuid": "b87a3300-765f-4028-841c-4fc2bdd6a5c3", "comment": "Malware payload (DCRat)", "value": "748a4bea8c0624a4c7a69f67263e0839", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277688, "uuid": "7778ab33-ff50-45c7-9e91-e93dcb69cfa8", "comment": "Malware payload (DCRat)", "value": "220d8f8ff82d413c81bd02dfa001e1c478e8fbea44bad24f21b3a5284e15632e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277688, "uuid": "3fd3b2ee-9136-4b3d-84e4-f642b9d5c1a1", "comment": "Malware payload (DCRat)", "value": "6955b7d516df38992ac6bff9d0b0f5df150df859", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277688, "uuid": "9dbc12ce-2719-4182-9c8b-d27778490d00", "comment": "Malware payload (DCRat)", "value": "c1f4513663af4711f416ac9f48ccbf87141511b0adb3883c2a4128a0b88d4b6ae5ad7ee4089c1a61fc3331bb8be36484", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277688, "uuid": "4592339d-3e67-461d-bc19-ddfbf0eee89b", "value": "T159C409283BE90619F17FAF79C6F06592DB7EB573B71BAA4E04A102860713741DD8063B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277688, "uuid": "e17cf29a-86f0-42be-a9ca-4745c5f21abe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277688, "uuid": "ecdb9524-8e4b-4d0a-af83-dd1eed4ad868", "value": "12288:aWMT5dtGv3Kom+qn4e9PtlAc7+Q4hMY1FOhcV:bMT5Sw++4ilAZ1OhcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277688, "uuid": "5f28c58d-c270-4171-ab2e-2b6b976139cb", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277688, "uuid": "1de5356c-e7b5-43b6-9230-bf3e1ccdabe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277688, "uuid": "8a778dd0-7a43-4c72-84a3-c7dff3759dc3", "value": "6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d1b79d-acc4-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1648272061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272061, "uuid": "0d6f699b-a05f-4fbe-8dc4-5745867f4917", "comment": "Malware payload (DCRat)", "value": "00173016b3299698fd1edf97fb0cc1f8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272061, "uuid": "e2e3d5ed-109d-4830-870c-435a67ef606a", "comment": "Malware payload (DCRat)", "value": "25174e3297ac9587d4f278bfa13f07d225d99844b41b93492f6ac102f867328c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272061, "uuid": "a8b40d5a-9875-46c1-addb-f705508b9a26", "comment": "Malware payload (DCRat)", "value": "de37f5ac5631573ef8fc0bebc72abefa91fcae68", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272061, "uuid": "118648c4-0ce9-4b44-a68f-aac0427d358b", "comment": "Malware payload (DCRat)", "value": "31b2e0c24b783f44d8ed7410d545db59d5fe96c9c5787e27fc77ed4e6d658a8c6ce0d8bd734b3a934664adf4f554f9b4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272061, "uuid": "0757733f-ad8c-475f-b614-afcca80f9039", "value": "T1E235590A7A44DE02D06E1737CAEF801583A8AD417E62DB1A7E9F335D26613A71E0D1DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272061, "uuid": "4ffec297-17fc-464a-befc-a3760b59b41f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272061, "uuid": "a39ea9c9-c517-4a9c-a8a2-1ffe3bd5c3c5", "value": "12288:549I/nL8TnKZPVHR3E/bS2vkRNJLXseJQdErvNKj6SKm+eAIhu181d6rsPH:5ngTKZ5RU/xG7zsEyEve6SZ+dIe8usv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648272061, "uuid": "9b199563-21c5-459d-9194-2e0aa7649df3", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648272061, "uuid": "9bfcdc18-14f8-4ec8-9753-ed247f6ceb77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272061, "uuid": "a35055e8-7f2b-4c30-931e-3c4895a56fa3", "value": "92Ug8Vr8GlCF24RhVe7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0ab4da-ac97-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648252877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648252877, "uuid": "c738c0ab-c65a-4e9c-a6e2-fb31b50ca991", "comment": "Malware payload (Heodo)", "value": "0003d37f2d7123d474984198d315eb09", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648252877, "uuid": "1dd81f67-edab-421c-9ba3-a58cc3030020", "comment": "Malware payload (Heodo)", "value": "264bcd26fc94f67ba5c07818eec5cfca0fa3ea2bcb4a3ac30a38b86ba74819c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648252877, "uuid": "04191055-d3ee-48f2-acfa-412cde725da3", "comment": "Malware payload (Heodo)", "value": "57cd7468d33dfebd1b48b85fef33e46a0469a4bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648252877, "uuid": "59bf5f63-09f0-4a97-b913-04964ca2bc58", "comment": "Malware payload (Heodo)", "value": "b1b244b74238bd41a986df6b6a246da51d99f988d8eb0691af901bcdda19bcfb220549b991aad5b1fcb67cf861219f9f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648252877, "uuid": "ee1d643e-a18c-40c8-abcf-e4ba985977a1", "value": "T1B8D47C0EFFD1C1B2D36B123019D5C64823ADBF2CEAA1C5B777A8BE1D69326C14512B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648252877, "uuid": "cc1ef787-d778-4ac0-ac50-6210c3c3b193", "value": "d63ab94f4bb6b5d2f0f6092bf07e00ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648252877, "uuid": "2d043943-32b0-42dc-9b85-f0a18e48115f", "value": "6144:/6ZMFXzqfoSHr/mvcQYbi2HN8C8BgifO7y7JcuVqrWLWN7Ypsi6Ih9vH0/oUHahE:/8MFX47ivcQMNsrD+KJjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648252877, "uuid": "ea0a2a2b-3339-41d5-b487-5bf0cb35f53c", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648252877, "uuid": "d776702d-bcb6-46be-a0e6-5236d3bd9051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648252877, "uuid": "7d57b125-b0be-4aa2-ba44-877c50433108", "value": "emotet_exe_e4_264bcd26fc94f67ba5c07818eec5cfca0fa3ea2bcb4a3ac30a38b86ba74819c2_2022-03-26__000111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bef71a-acb2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648264270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264270, "uuid": "3c3972ea-a4d2-41ce-85aa-75f70e99380e", "comment": "Malware payload (Heodo)", "value": "87a72485a2ababb99906683a681a3ce3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264270, "uuid": "249d35ce-a606-46d5-9b22-4cfdec2903e5", "comment": "Malware payload (Heodo)", "value": "289d7082517b1b2d533c9e0a565f258963004f9da3c6e49e961da4a7fcb4b2d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264270, "uuid": "043e7ec2-9cb0-4b4b-b1eb-f08d64512dec", "comment": "Malware payload (Heodo)", "value": "5b446807f238dbade5f9919f0a55950f45f167e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264270, "uuid": "626d1db9-6d08-476d-8023-2c47fec2134f", "comment": "Malware payload (Heodo)", "value": "b34d29b811d314c03811c951b4174b43f73753cdec71ac944d85f6f9f686ae16a14b15258a9d45f6c45dbe2b78e0fd26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264270, "uuid": "51996507-2a7d-4120-a59f-c784803e5e0b", "value": "T16A445DA75AC3C067E51B06B9C7595008B157C632775AA6EF37C1A71FCA3C3A2B7380A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264270, "uuid": "13fe0e33-9ae8-4dc0-8db0-6cdacfcac6e8", "value": "6144:wGOAWAyzLzHKwJrCf9dJJjI1rQlzLOu7H7pLYsDgiZ+/TccZr40HOnUqSEw:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648264270, "uuid": "deb05a53-6825-41f6-bb58-34ad9241a567", "value": 265464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648264270, "uuid": "5523343e-56b8-444d-a691-b3061455c0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264270, "uuid": "50d26205-3f39-42c6-bfa1-657cb26c9898", "value": "emotet_exe_e4_289d7082517b1b2d533c9e0a565f258963004f9da3c6e49e961da4a7fcb4b2d6_2022-03-26__031105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c822a7-acd1-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1648277608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277608, "uuid": "721be9e8-dbbf-489a-99b8-b6ed1c2e19bb", "comment": "Malware payload (njrat)", "value": "e817d74d13c658890ff3a4c01ab44c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277608, "uuid": "ea952ea7-e237-4997-83e3-e6cb7751cba9", "comment": "Malware payload (njrat)", "value": "2945881f15e98a18d27108a29963988190853838f34faf3020e6c3c97342672d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277608, "uuid": "62766faf-d930-40de-ba6b-be3ef3f3bc8e", "comment": "Malware payload (njrat)", "value": "bf0b97392e7d56eee0b63dc65efff4db883cb0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277608, "uuid": "6330677f-e011-4161-90f8-b28aa9c8b7e9", "comment": "Malware payload (njrat)", "value": "43c13e712395108aa1cfe895800e9ecd467f6ff7cdfcba8e2f41ef0b47e749301a016f6dca4b8566a5c292563d37bbed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277608, "uuid": "356394d6-3d01-471c-a931-84ed4abe7d13", "value": "T140032A4D7FF18568C5FD067B06B2D41207BAE04B6D23DD1E8EE5A49A37636C08B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277608, "uuid": "771d0ed4-6fa6-4a4b-af33-360ae7df590c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277608, "uuid": "aa4b2b42-e9bb-41c7-91b0-3b08cf1d79f2", "value": "384:wkL/jcXCisnfcR9L5YXyc/ubSpMnqzfP2VItbGERZrAF+rMRTyN/0L+Ecoinblng:TLsj5Yic/uOr0IwEjrM+rMRa8NuS4tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277608, "uuid": "caba7c3d-1a55-45c9-8b1a-e8801ddebba1", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277608, "uuid": "e1dbcd0c-ff54-40a5-be96-db750a6a1eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277608, "uuid": "57127bb7-ba8b-4db4-a7fa-3232ffb8165c", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc686c72-acd5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648279506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279506, "uuid": "e85fe8b5-b72f-4920-9dca-dff7da73a0fa", "comment": "Malware payload (RedLineStealer)", "value": "6e0218862bba97b4e9fbdc3ea49f3572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279506, "uuid": "1682e32c-ae5a-4562-a907-0e713343a7e1", "comment": "Malware payload (RedLineStealer)", "value": "296b8e5bc9612c4c2be4965f84ea30b39c8231521fbf5651bc691fa4d038e0c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279506, "uuid": "67ee19e8-5e97-4f7c-b5d6-9b962335bd97", "comment": "Malware payload (RedLineStealer)", "value": "b7ddf449cc77f57aa689904d31c43c2e54608865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279506, "uuid": "284102a5-fc75-441f-85e3-7004028a3666", "comment": "Malware payload (RedLineStealer)", "value": "0c445f68eb5527b4f93e2a634324190edf6341a97b4b5d399167ac4c0470d75ba9c44d380e6d679dbf138e36c2473b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279506, "uuid": "500c2e15-e563-497d-a51b-a371b61ce246", "value": "T1E4D423CB23943D0CCAC96FF035F6AB598E60D361BDD8511B632885865A857F2EE2807D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279506, "uuid": "a33ab6c3-27a4-44ca-ba00-f1d45aa7bf5a", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279506, "uuid": "23058d1a-e537-4000-94c6-7bd936429b56", "value": "12288:x2ZzbnPLQmM58mwe1K7JQS03ULaHNqrxlKIQNoCEqolY3NVzrEe/:KbkT5RwAwJkEaHNYK317oy3NVzL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648279506, "uuid": "bdb0633a-3604-4813-bbe3-499819f69e92", "value": 648496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648279506, "uuid": "e8a2e085-0f65-4ce9-a9b1-143ad1aed898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279506, "uuid": "7a5198c6-c2a4-4799-91b0-f19d7564632d", "value": "CherryHack - Call Of Duty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99ec44a-ad2b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648316465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316465, "uuid": "e19c7638-ad3c-4bae-89ca-742b2e1510b1", "comment": "Malware payload (Heodo)", "value": "a631883d397ad88c0744e4405a66a1ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316465, "uuid": "8b11e50e-f49f-4ce5-b7ff-caad9084f819", "comment": "Malware payload (Heodo)", "value": "2bf2f5f5fb6a3c64dfc092635d375da850b403c35fadabe4d74377d1c2b77938", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316465, "uuid": "2a4eae53-f685-4568-9bb9-c4ea65297a83", "comment": "Malware payload (Heodo)", "value": "a95c8dd6b8a275d3360799a632a3ab71dc4bc0f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316465, "uuid": "fb2d335c-df70-4073-9a44-4ad1cbc35a67", "comment": "Malware payload (Heodo)", "value": "3e93c162adea15c5df80c8602bca26223a24e5a0a0deb820bd81261b33e7c7e40d0ec366ddc59a8d7f79b717d724d364", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316465, "uuid": "789c80ca-6b28-434f-99f0-863cc0bb138c", "value": "T1BAD46C117691C832FC9A5F34359392BD1FF87F64AAA48227EF903A4D6BB35008E146D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316465, "uuid": "e2f83ed0-4c3d-4113-8d44-da2a4c2a9ba5", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316465, "uuid": "d86d54aa-e394-46fb-ae32-8a4594f4a2d0", "value": "6144:XvRov7wREVy3B6yu4YXep2v5uYxlsmsgrR8drCSi78SLUYeDrQ0Ax+xSEN:ZsVyXu4YupcuYUmxrSsmD8fx+xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648316465, "uuid": "45462ded-0bbd-4c59-9369-4b20bdac866c", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648316465, "uuid": "35ded926-ab18-43c7-9540-5cdc854cc126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316465, "uuid": "f66ecd7b-38f6-4e73-9847-2b894d2ccfb7", "value": "emotet_exe_e4_2bf2f5f5fb6a3c64dfc092635d375da850b403c35fadabe4d74377d1c2b77938_2022-03-26__174059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837f5615-acd1-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648277639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277639, "uuid": "fb3b9e36-7ed3-4f18-ab64-a1037b45e5ff", "comment": "Malware payload (SnakeKeylogger)", "value": "6f715dbf8ea610710f311dc1beb3a4e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277639, "uuid": "39c20ca7-1f76-47fe-8a5e-e98b6085e747", "comment": "Malware payload (SnakeKeylogger)", "value": "2ff72350c5fe5280b47181095f061645e0b9f11833a7659408580240556fea61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277639, "uuid": "61b9e73c-aeab-4d35-af1e-89981be4b172", "comment": "Malware payload (SnakeKeylogger)", "value": "1fc9e45d67eb10dcfea4065773dfd0d560c7a938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277639, "uuid": "b747ceb9-682a-43a1-86a0-846c84f0404e", "comment": "Malware payload (SnakeKeylogger)", "value": "1276846f3ec70384abc0334e6d08f180b395fee40de0bbbf32397d88bf5ad1fa3f50e191f2e23984418e825322f01ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277639, "uuid": "ffc29a69-4528-4e14-ba1d-0377b54f7a7a", "value": "T1432512122DC0ED02C1B50F314C756489E734E3A57519DAA8F8ED22379F23AA58B37BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277639, "uuid": "0f387375-4ea6-46c3-b059-ae414e97851f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277639, "uuid": "40df7814-aa7e-48d3-99e0-e342f5dc77b8", "value": "24576:GeTvDyVBXy/WW3G0IQSbtutzHMwemguDF8TA0HOXU:GaOVO13G0ZSbtczUrtHoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277639, "uuid": "623fce7d-35b1-4a35-83a6-4e5b4e37caaf", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277639, "uuid": "2353788d-f3a0-4562-972b-5b4f30a202e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277639, "uuid": "57f83aee-959f-4995-a294-45ea89277331", "value": "vergi \u00f6demesi dekontu 25.03.2022,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01602a2-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1648277258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277258, "uuid": "140631a5-4551-48f9-9e9c-c9f4084649f9", "comment": "Malware payload (AgentTesla)", "value": "ba2258324fc45ea8d9d7d5f94f50c8f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277258, "uuid": "01c805eb-fdae-4f24-ac09-63361d87ba78", "comment": "Malware payload (AgentTesla)", "value": "303bac353481639b2ead5860845f621f9f70a8282e31ecd3cb5c5d3fafaeb38d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277258, "uuid": "2b394b78-9c98-4e94-b9cf-1b1eb0360de6", "comment": "Malware payload (AgentTesla)", "value": "7173d2dbcae0cb1725768d9127ebf159e1997238", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277258, "uuid": "e35ba893-b265-43e6-995d-7ef7d1999ff8", "comment": "Malware payload (AgentTesla)", "value": "e3e4fb244fd772ca96e39a82b862a9cb0247d0fcbcd5765ba5c761d41a32de5a12577c3244b2c4f04e0a9e3775a8f6c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277258, "uuid": "27a0aed2-99f2-466e-b6f7-a5ad70b53971", "value": "T12D3306A01241ED4DEC1A42335475965F03E5AC11AA7FAACF3C3F72C64B7E2A7332A518", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277258, "uuid": "ed9be6a7-b284-4948-8b3e-0d9643e84f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277258, "uuid": "0d6257c9-12cb-431d-b4ea-843c09ad272d", "value": "768:b4rUy3+FG4nPv0SbFWFTkEgF2UukwX8O5s2XMSpRobgr4Z:mIG4PviF4/VeF5FXMSpRL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277258, "uuid": "7e048bea-038d-4093-ad9a-e9dc8eabe7fd", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277258, "uuid": "03549a6c-63bb-490f-9ec4-11b244e2bf38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277258, "uuid": "5c25c6bf-f9f6-42f6-8b56-b18333cf865a", "value": "ba2258324fc45ea8d9d7d5f94f50c8f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f39914a-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648268854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268854, "uuid": "054de2f4-86b2-4924-8654-b9ec70aed71d", "comment": "Malware payload", "value": "4685811c853ceaebc991c3a8406694bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268854, "uuid": "cc71b385-6564-4af8-9989-4b0e28f9e8ff", "comment": "Malware payload", "value": "3242e0a736ef8ac90430a9f272ff30a81e2afc146fcb84a25c6e56e8192791e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268854, "uuid": "1e7e6b74-4021-4ee0-b29b-3f8723ab709f", "comment": "Malware payload", "value": "9cd382eb91bfea5782dd09f589a31b47c2c2b53e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268854, "uuid": "d8057017-d8a1-4125-be51-2cc3e304e8bd", "comment": "Malware payload", "value": "35892dac16fb838d7729a1485ccc05c5f7bb154f7405736609dd9c595a8da7dc4b5b184a45a11b244ab736c691055d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268854, "uuid": "75ff3171-abbb-4c32-ac50-63a707bb1346", "value": "T16A157B42B3D7C0B2EFA119F2C57997362939BC35533888CB73D4382DD9A06C16A7535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268854, "uuid": "9fa25848-6794-4276-a228-b39207c28b01", "value": "6c272312b690db5e72b315f1bb1db5b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268854, "uuid": "e03f83c7-7b0a-4251-a45d-5fa29f9f13ce", "value": "12288:oo6hrwBWQ1Ow8yPcT3ZinffOqJaFLGRTY7c223KmZaQRDSGEi:oo6dwBTj9U1wffO7FLG5Y7K3KmZ0GEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648268854, "uuid": "a884d8f5-dd81-4e65-9532-46c47d9a92c0", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648268854, "uuid": "55a1306b-6731-48ec-ad09-be69336a1d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268854, "uuid": "b5c7a377-709d-45a7-8eae-ec17136ce3b3", "value": "SecuriteInfo.com.AutoIT_Compiled.11820.19429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622c455c-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648310654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310654, "uuid": "eb24a7e9-dc98-4b26-a0f5-c4b69e09a260", "comment": "Malware payload", "value": "5d0a6d432b512d0c704e02c8c6a7b52a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310654, "uuid": "e009f339-2ece-447b-8eed-60448f4ec6b2", "comment": "Malware payload", "value": "345a5dae6ce116d5a25d15810c9ad08a822a77590e159b067932a11e4ace3f7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310654, "uuid": "b9481250-057c-4dc7-a7a5-80ecc463e13c", "comment": "Malware payload", "value": "ae70939ab24dc672805f57eade420e34c81d4126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310654, "uuid": "9da1a94c-93ec-4ca4-b661-c00c520beef6", "comment": "Malware payload", "value": "76f3e364b66965412da583e0daae8e812c72b7f7600766539d807ed6872c84a467c4ddebb9a168366e0498e2b5365a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310654, "uuid": "44c63c3f-83e8-4682-8887-2a3e4b142518", "value": "T17436023536934499CB380BB740399AD673B4BA4B3E6DEB2E71D7278C8D4112F77090A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310654, "uuid": "fa008ca7-4639-458b-8712-bcbc7bd5ebfa", "value": "98304:irDWx+sEyGH9uTxld4arwlwZ6szR4QR66CxVCiKjB:iWx+sUH9oXdfrwknr+VC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310654, "uuid": "c22fe5c4-6940-41c9-92c4-5bd732f71bc4", "value": 4945830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310654, "uuid": "1de74495-466a-48ab-916d-161cb4319c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310654, "uuid": "97dd59b4-cc1f-4945-af89-2b1500ab8354", "value": "5d0a6d432b512d0c704e02c8c6a7b52a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4abfb3-ad1f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648311260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311260, "uuid": "6c3a45b2-01f4-44bb-ac09-f830660c6e49", "comment": "Malware payload", "value": "3b4b9f2062f138cf8e5cb227e552df95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311260, "uuid": "913f0a40-f673-43d1-9ddf-280a46722daa", "comment": "Malware payload", "value": "351005b15770bd45ef67169430ffc8b6ccc9d7ec3ee4dc8d6b196f0ab80acf66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311260, "uuid": "19db85e6-5af1-4b26-b5f7-377a19bb001b", "comment": "Malware payload", "value": "0085152bbbff231fd565278bc6da398f6458585f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311260, "uuid": "4de82fc5-fcc8-4648-86f5-241aae726f79", "comment": "Malware payload", "value": "354beac1f0aaf970045df999680b376a30efd9cceeb1e144e4947ac13084d0aa7876a0aa893d00b72d89187f0a66bbe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311260, "uuid": "e6ea2a85-fd97-489a-a414-ae140834a98e", "value": "T17DD533A09AA7CC58DFB00A72911BE6B07606CD2F51F3959866DF0C43F909ECDE74D898", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311260, "uuid": "b7ef15c8-f69a-490d-a385-beda96f2c796", "value": "01d1b984e99e67b6f7ae46199d7dfd92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311260, "uuid": "beb8b207-2165-4083-8595-7de5261d47fa", "value": "49152:GEEgxUKYWepPKhCH9T5JrBSisaYsOp83qcF3FwYk0x931p/TX+GLa/JRr:GECPXZKhMHSiuvuaDYV/z+nJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648311260, "uuid": "be63aed0-15d2-4077-8cfc-4c1e4a1ef801", "value": 2788968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648311260, "uuid": "f5c418fb-22b3-4437-bf6f-d3290f200aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311260, "uuid": "f7e1bc00-e6fb-4e25-bdc8-fc7e03a3a01b", "value": "3b4b9f2062f138cf8e5cb227e552df95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ce4477-ad27-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1648314665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648314665, "uuid": "17dd11a5-bd23-4471-af4b-c09f9ff97e77", "comment": "Malware payload (njrat)", "value": "ca301e375937433b697ef6eeae67049a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648314665, "uuid": "7a3e4b18-2958-42aa-809e-365bf10caf5c", "comment": "Malware payload (njrat)", "value": "35bb756a7fa61bf50a8c3515b110049c8c30c627130764ad7f1350742933cb85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648314665, "uuid": "5c0f861b-cf9a-4aae-84a2-12711b3deda8", "comment": "Malware payload (njrat)", "value": "a44f89bbc4cd2a98cac6d91bbc5cb47258dbc43e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648314665, "uuid": "021330a7-f447-4406-90ae-1b254bc3aeba", "comment": "Malware payload (njrat)", "value": "a5c086e35c58710289cf87f465c797df9931d57e6b618822b6bce9d6da1d6e019469c59aaf4dbf3c6ceb8d5eb23e0491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648314665, "uuid": "2ca8e89e-5064-44a3-bf09-43e33a0db24b", "value": "T1ECE22A6DFBF64466D2BC0AB50571950013B8E103E523F77E4ECA24E62B6B6D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648314665, "uuid": "253247e4-1eaf-4527-a4f9-ed32bd0e2b74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648314665, "uuid": "fb5fe3b4-3bd7-418d-91db-23e7bf0b48b9", "value": "768:kTwoqkZlH/azx1+ta+q3U97v8+QmIDUu0tiK7j:X4qSp7QVkNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648314665, "uuid": "0cba293f-7cc0-4a3f-9348-d94682ce3a17", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648314665, "uuid": "6a748455-b337-45b1-a0b4-a0df0e249c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648314665, "uuid": "3683b1b5-4815-4fb7-b4e1-8ba48cb64c56", "value": "ca301e375937433b697ef6eeae67049a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44570b78-ad29-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648315329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315329, "uuid": "67b15c47-8c50-41a3-aecf-283c64ce9b44", "comment": "Malware payload", "value": "e7da3cc40bdf037e5384874b9dc29e66", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropperNanoMiner", "colour": "#40CDD3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315329, "uuid": "801cbb83-dbf7-42dc-aa80-f9be7a0270d9", "comment": "Malware payload", "value": "35dd5afe686a9d71d92e1ee99636ec07e99ebd0f92a6acf55b339df93518e86f", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropperNanoMiner", "colour": "#40CDD3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315329, "uuid": "5bc0bfda-45b8-4cfa-bac7-a7abe4841c1b", "comment": "Malware payload", "value": "7e6ce76c925f481e98fc14e39101f968e54ab5e9", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropperNanoMiner", "colour": "#40CDD3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315329, "uuid": "61637c76-c606-4b25-a1ef-2c5de811c43f", "comment": "Malware payload", "value": "e81d048057e60c8a5c2a23a3968fae0a9aaa71bc5a96151b9a8ab1812c22c63a9e72b1b0ee6fc1e150bb1672c8506c67", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropperNanoMiner", "colour": "#40CDD3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315329, "uuid": "d06bf1c9-6ba0-4ee8-a2c2-ee0da5e49ac7", "value": "T1F541AC02BA1A1732C1791C94E6A76201D809618B35164F2C727CCFE6BF23AF7C14A68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315329, "uuid": "f41ecda2-9bd7-47e4-9ea8-b0495ef2b330", "value": "48:L1YXWhjbgRnNUjy4b4RigyFXM6AZ5QGW19R3ALGRiEXMiMx5k6/Xg06Ii:LUyjbSnNlXRiJFXM6AZhgwS5XMiMxThi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648315329, "uuid": "c4d310a4-3ed9-4226-8840-55d510048089", "value": 2282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648315329, "uuid": "8fe2e33e-fb41-47b1-b4af-1924b2ba1cbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315329, "uuid": "56201406-991a-437c-95d0-178917ba6c1e", "value": "4V6Jpwxh.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765f6cbc-ad4d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648330875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648330875, "uuid": "8399cf42-dd54-462c-9544-3f0b693dc144", "comment": "Malware payload", "value": "b578f712997625c0c97ff55b70152bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648330875, "uuid": "9921d526-7d63-4136-9d45-8074831a97e1", "comment": "Malware payload", "value": "382da46b770736639b495071c4c5a0b139eb486583b7b9548274ce6e4f663cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648330875, "uuid": "d34e6b54-4518-407b-917f-a4ac73482f54", "comment": "Malware payload", "value": "c121a71f77852693f62a3ead14ed0269b27ee754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648330875, "uuid": "494c6aaf-ac50-4d20-960f-970d126e4792", "comment": "Malware payload", "value": "9a449e5de775ee2eea46ab275d1d1c510086dc864b7b1a742d63166234905f363df2340f1f95f7c3f62979499f2ce401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648330875, "uuid": "36ed4a64-43f0-41a9-9986-776abcc43578", "value": "T137948D05FA83D1BEC967597014BFF23BD630091D41069F67FFE89E60BE5AB10AA0D609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648330875, "uuid": "8e563fc4-d082-4e02-819f-f3b67a143a6c", "value": "d6247b74ff5623cf80dd1bb6359eeaea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648330875, "uuid": "d361a8c6-e959-4534-818a-a9f332ef65f2", "value": "6144:w+yrMxaShH8viQTod6Y2N2k92LH4yy7NK3htp1Yyi93I8M45l7jwaSRY/qeJqgJK:nyocv7N2WyuWpGNM437jAY/fJwqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648330875, "uuid": "0e80af21-2df3-4c19-ac8c-4d492b25c60e", "value": 420366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648330875, "uuid": "928fc259-0d52-4743-9ccf-6799c338e8d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648330875, "uuid": "57f7809b-7cc2-412e-a06f-d2170db79af4", "value": "382da46b770736639b495071c4c5a0b139eb486583b7b9548274ce6e4f663cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b5594d-acf8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1648294422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294422, "uuid": "70092efe-ae3e-44bc-a611-46aa5a9422fd", "comment": "Malware payload (Formbook)", "value": "f8163569762a4ae71f4660223197aa56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294422, "uuid": "be2f036e-273e-422b-a7d5-c7e3ad95b68f", "comment": "Malware payload (Formbook)", "value": "392ccbb90587006cb88f15297f40b3e17ef83b37f8171d435d519600065e9d55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294422, "uuid": "13598509-3989-4c2e-9b80-ed515b5227a9", "comment": "Malware payload (Formbook)", "value": "526fa33ef8af4faa04059e452ffa7cbfc78aa4de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294422, "uuid": "3eaf08dd-0a3e-4786-9638-55f3738c6d5b", "comment": "Malware payload (Formbook)", "value": "9f6c9fc1c085b6d50c2df2869afc0bef3c671a8f5c6184f0c48375a52f0dc88e50caa3cb662cea6d0b34954175452612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294422, "uuid": "0186f69d-0659-44a7-a87e-aef44e81515e", "value": "T1F92512422EC4ED12C1B50F710D7A7448E730E36A6219DAA4B9DC217B9F32BA05B73BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294422, "uuid": "caaab093-64ff-40f8-ab3f-daddf8686859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294422, "uuid": "197e40ef-7209-4519-91ab-4f0abcc6e31a", "value": "12288:sFewYs+C2SXgTkd3dKXPvSuPfPBFzNdGQ81g1In++VLtZIYH1lZkm3Wri0/iKWe:sFewYnwHkikfpFzNUr5nnDXVTkmMt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648294422, "uuid": "4d4fed74-6880-43c2-b68b-c164e2f95ec9", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648294422, "uuid": "deeda8ec-6581-42d4-ac7b-812747273434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294422, "uuid": "bdc62b7d-6150-49cb-b54a-108c203a538a", "value": "Bestellung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae1d0d0-acd7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648280041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648280041, "uuid": "0a290c5b-20c0-4fe5-8c59-daf619b03ea5", "comment": "Malware payload", "value": "90af5ee63b6384d4aee1fbecda300680", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648280041, "uuid": "07e301fb-f4f6-412e-b424-acd8aee2fb47", "comment": "Malware payload", "value": "397952bc653afe2a19648bfccb38a34785259a44c87733aff94cb545e8de3a49", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648280041, "uuid": "95cae55a-4020-4bb9-bd7b-ffb74e1c0274", "comment": "Malware payload", "value": "4139dff1ff3d46774b05a8c0ad201a92a7caeaea", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648280041, "uuid": "1bb8a393-9e63-4639-aa45-e69c99308010", "comment": "Malware payload", "value": "5d897b796a916afc8f80c80ebd6c6421946e544b8833860f717d7f9c010a61f3c860594e9b66ae4721d969c6a95d38fd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648280041, "uuid": "96027569-f68f-45e9-8217-154e5d4ea5b1", "value": "T1F5516CCB36C6CB00D6656273C6FB1ABCE9CCA75E60607EF9450225DB86920C20E26772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648280041, "uuid": "eeaac342-17aa-4d89-9316-5edff02c5eff", "value": "48:9N14sYncohhf7iB9gNwrHv5F9SwNqW/qmllop2o+l+w:gcohOWNyvIuwsoel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648280041, "uuid": "fa879d7a-7937-4ad6-bedb-021b6cba24d1", "value": 2603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648280041, "uuid": "c366f32a-8550-4575-8c95-bb0c67f7aefe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648280041, "uuid": "47f2f251-ce81-4e3a-8f94-e8f86f1bd5c7", "value": "NOTIFICACION DE CITACION DE LA FISCALIA GENERAL DEL ESTADO ECUADOR.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4849795-acb1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648264085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264085, "uuid": "7ced1f3c-feb7-462c-b35a-e6ff050720e1", "comment": "Malware payload", "value": "4377e3d8954820efd8b561fc8a7f6053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264085, "uuid": "7fd69183-ece4-4476-a826-a949ad3ced0b", "comment": "Malware payload", "value": "39ea2fe52a0e8a2c0b521ced12cb5e7836a0824bfc87b9f2793803f3056d48cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264085, "uuid": "28b89884-8954-479e-b155-80a569d96cfc", "comment": "Malware payload", "value": "39ee2adb8ab31793641e34725634b61a4a4b0b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264085, "uuid": "14977ce1-df37-48f2-bd85-3efd5d8a3aae", "comment": "Malware payload", "value": "a9ccb6e113b52bd8aca32125b7231138654ea8f4511a3766e4449efaddc2175f5c17614edacb98bb8c2f7f6fc346bba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264085, "uuid": "c47b64ef-ad53-44ca-8d2a-fb76b0fb21bf", "value": "T128645B20B353F672D46148F84E6DAA66B91DAC081B249BFBB3DC3669ED351C04A31FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264085, "uuid": "77a9897c-3c4f-4b17-9dfb-2703450253f7", "value": "c407c35d6718837478b82033b2827e43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264085, "uuid": "8cacfb58-d48c-443e-9c3e-b42abc88cf42", "value": "6144:f/s86W766rQ66548kUmsRsvwhCQcV4lChjX70tfqTi8wzv5MaImSjIxgOGz24hYG:8sPAVYRQTBA+0hD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648264085, "uuid": "b6d54ae7-e3eb-499e-9f3b-1d9f52b691a5", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648264085, "uuid": "c054fb43-e1c3-4a8c-a084-b57825c19081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264085, "uuid": "e19aa16b-3ca6-44c9-b378-7fd7a6c05ddc", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace0ddd5-ad33-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648319799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319799, "uuid": "9551c4c2-4e1b-46ce-a7bd-4edd3b3f2e01", "comment": "Malware payload", "value": "99854defa6434a79dc9c1d7293d792de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319799, "uuid": "477e2af0-8985-432f-9672-fa2dd2908158", "comment": "Malware payload", "value": "39f819e22df56e1037a7e269379a08f0e5aaeb20cbfdb63f868757dd210d33af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319799, "uuid": "262a8d1c-e796-462a-9c2d-ba2fa189ec37", "comment": "Malware payload", "value": "2ed70c22c33b5aaa6550131d8eaef267f3a6a2e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319799, "uuid": "7452e410-22f1-41b3-bb8d-8e5e3afa6c39", "comment": "Malware payload", "value": "3b8d04193d8738e9aad5c4e3712098b2ba609f8f0d7518ed8d38c0e435015d8fb25192416f4dd21f4bf01a5573eb538d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319799, "uuid": "072b0b74-d6de-42b7-a250-49bf94999eaa", "value": "T17366E01EEB854473D91A12339828A322D569F174E7258FC3378A5B1EFB742C32E37196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319799, "uuid": "a7cbe067-4226-4560-96cb-3fb757344f59", "value": "f9ff3505ad874b4a20a30a0fb93038e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319799, "uuid": "dff001a8-bcf5-4f22-ac41-29b341c8757c", "value": "98304:rieqhadX3BqpNzCfATEFgft5rG6uPO276HoVNmnolMsFiHtGh1hN5DTlF01Ati:rieqhygp3TcGtbuPZOOmnqogHh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648319799, "uuid": "19a08f51-4aaf-4d4f-a8cf-62bb5451f981", "value": 6819840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648319799, "uuid": "36e5aa2c-d98a-4a44-b304-4ffd2c87184c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319799, "uuid": "1714b407-8bd6-4aad-a777-19e775974465", "value": "AcroCEF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9e11ef-acc4-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1648272069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272069, "uuid": "4ddcf5ff-b241-4a0b-98a6-a70a4028c395", "comment": "Malware payload (njrat)", "value": "d2200520a904aed95459433968582c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272069, "uuid": "53916d90-0221-43f9-a5c5-9a614d49f2a7", "comment": "Malware payload (njrat)", "value": "3dc512c40b9afc7fa8f834f52d79261d585dcaf041dd7f34278bd19b9e2b5fcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272069, "uuid": "20d10f0e-eae2-4ce2-bf3f-e4a5be6770bf", "comment": "Malware payload (njrat)", "value": "b89ed435644c9e121597856fdb55ee5ea94bd1c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272069, "uuid": "ad6ac52f-1498-4770-981b-b1c37ef86fcb", "comment": "Malware payload (njrat)", "value": "4973d15bdc708553da5ee1bef8615c59a617a093426d59be0e396ac10f0ffa57ad04d770ebf5b6cc67475167b748a193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272069, "uuid": "bbf56c3c-4507-4380-9ea3-08ed4755cc4d", "value": "T11DE39E266E202B7AC6E18973C055C73E17160F759885C63B05CA7F1BF88B0ADFC61A9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272069, "uuid": "a806a9a1-c42e-4564-b715-e8f24f868ce2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272069, "uuid": "a5ba8b0c-ba10-495b-85b6-05f21985aba0", "value": "3072:z9c59CsBrlSSSzbFDKFg5EVC/sotH8waDk4KOUZ9r:ze59CsBNSPgu5BsoGfk4KDZ9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648272069, "uuid": "6ee38eb9-ef1d-432b-828a-98440475ce99", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648272069, "uuid": "54fced48-9559-4881-9d02-d7724afa89a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272069, "uuid": "e54e6cbc-d99d-4ed4-a2ac-db8764af70e1", "value": "Days Gone.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb62627a-ad0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648302644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302644, "uuid": "7e21f226-7477-4641-81f1-2fee50218d44", "comment": "Malware payload (Heodo)", "value": "c190f8889ff487d747ae7913f6d748fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302644, "uuid": "438d70c8-b5e6-4185-9c17-052775252654", "comment": "Malware payload (Heodo)", "value": "3df93df944318c011a1e7bf6d9f4c2b2a13de0537ce3069094da883d72c56efb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302644, "uuid": "86151528-68e1-4860-8124-80073d73b764", "comment": "Malware payload (Heodo)", "value": "a789a6a17f780d3cc34a62abb622c8ca69e5c4dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302644, "uuid": "1c510944-6ba9-4819-bc9b-e3e315677c5a", "comment": "Malware payload (Heodo)", "value": "ffbc7dd4525c7b5574071b5d8469bae3aad9dc950a31597e4e3834f02d6999f0c3e2843fe084cedc4991f3bedf79e94e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302644, "uuid": "b5933ad2-561d-4ea6-88ca-1e713f4b43a9", "value": "T16174CF40F2DA847AD6B72B34257247266A7AF9127F38C38FB3548989DE31740DE3471A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302644, "uuid": "9b4e5c2d-9249-4492-b2c8-78eb35a2711e", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302644, "uuid": "5ea7d4c6-0ee5-415b-81ce-e1152546333f", "value": "6144:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB9iHC4CqhAMQvYqq/9CR:3Qw+CM2n9+6qsRlSLhIe9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648302644, "uuid": "9bf74522-77d9-4246-b75f-69b4b92a726f", "value": 364062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648302644, "uuid": "1994e944-8ba2-47c6-83f4-29dbb676b561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302644, "uuid": "6929247e-0226-4891-905c-451b667b6fbb", "value": "emotet_exe_e4_3df93df944318c011a1e7bf6d9f4c2b2a13de0537ce3069094da883d72c56efb_2022-03-26__135037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fd9f8d-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648268991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268991, "uuid": "9864de9f-d5ee-4402-a217-b45e9017a9d5", "comment": "Malware payload", "value": "c08ad8c0574ef99d351944a4b95d7941", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268991, "uuid": "9ebb022a-257e-4f43-aa9e-0e59f4e4bbde", "comment": "Malware payload", "value": "3f2d01f7b4fad99b7470f8688cbd4c6c1498aa150f3497f3a9f27e24cc97e39d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268991, "uuid": "adf18301-7cdd-4f77-99d8-2bde74c4f632", "comment": "Malware payload", "value": "0dc927b7af6907609ba6ff95d8b7db96f8e3348e", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268991, "uuid": "f4917f4f-3dc6-4502-b0dd-2867483a8868", "comment": "Malware payload", "value": "043c28f8917354e60e26b204da50ae17f571c876064d37dfca464f3a21852ead2c3cae0b76b252376022a0279d6b4faf", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268991, "uuid": "b334aabd-105f-46d9-9764-387338af01f7", "value": "T1D2D18757FB0402F7C09D1DB911BD221697BDE23C26D8A04EDF8498252C9CDE9BF78649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268991, "uuid": "c1c334d7-2368-4ad9-b2f7-411c179dd316", "value": "0ed11c14a2759c69bfa93dd64e1f1654", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268991, "uuid": "f30520f3-9b15-4cb9-836f-413d22cf8eee", "value": "48:6+gx5YVOGxVUTOyzRw9EgtNDjiOo0RB+BDq9J5ScX3l:0GxVUTRS5NDj5HB+FqX5ScHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648268991, "uuid": "b49bafe1-5aea-4341-8474-43962fdba0ce", "value": 6657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648268991, "uuid": "8cf4388b-32d0-4175-b101-731286cab79d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268991, "uuid": "be73f751-8f88-45f2-90f2-8556d43e1901", "value": "ax.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88668745-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1648310719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310719, "uuid": "a9922830-f744-4a04-babb-b9303efbfadc", "comment": "Malware payload (CoinMiner)", "value": "577be233e5f19c39ea21ad986e5cce56", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310719, "uuid": "00161268-6ed1-4aa3-8679-3d3bf75aa79f", "comment": "Malware payload (CoinMiner)", "value": "3f3bf242dca91e0e140cd9b41d146ecda6b3644fffb574fec3a2cbae723c8d34", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310719, "uuid": "c66b2640-8377-4c25-ab15-479c98d1c2d7", "comment": "Malware payload (CoinMiner)", "value": "1988e3e907e677d143fbddf16843f46c85a955f1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310719, "uuid": "106da56f-e27c-4b88-a5b6-20a70a1db88f", "comment": "Malware payload (CoinMiner)", "value": "1cc85f0be3960a152353f85efeae553d14ee952140e59ec329a8d54517711f37df7e2dc1f1a9052fdbce29be20b4b7b3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310719, "uuid": "2d59039a-43d2-455c-813c-17a4758a5047", "value": "T114E502B86160335CC41AC4789533FE44F2B1552F4FF8A9BAB1DFBA803B6B454EA41E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310719, "uuid": "cbf21c09-9a61-48d4-908c-90b91285422a", "value": "4e4095a0d90406c8428c5d9a9c6b05b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310719, "uuid": "6e53531e-b118-4def-8879-5b895b5fd2f9", "value": "49152:ADg4pPJV9L8pLiOzlyZ6niYM57Vdv2FnQRAN3A+HKnwIH6rLCO/2aex:ADgc8pLiOpyZ6+57DCQabHm++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310719, "uuid": "c477a6ea-3b4c-485b-8f47-9ef6fa2e1e11", "value": 3088857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310719, "uuid": "f7d057fb-55e8-48cd-9c24-f40c494cd019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310719, "uuid": "020c34e7-7353-4a45-a066-81707b899cd8", "value": "577be233e5f19c39ea21ad986e5cce56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970355aa-ad1c-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648309884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648309884, "uuid": "d3f50f63-ba22-4df9-8b57-1be0872108bf", "comment": "Malware payload (SnakeKeylogger)", "value": "5adee682bd206aea7de664b85d22220a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648309884, "uuid": "408b224e-44ba-4d92-9532-1be70d5b6481", "comment": "Malware payload (SnakeKeylogger)", "value": "3fc4db651c68244e1d6bba7c4449974deb3a9f83b853988288dd449e009257d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648309884, "uuid": "bf0aa7a5-4727-4cfe-a08e-91208d3827b8", "comment": "Malware payload (SnakeKeylogger)", "value": "541c3ebe2d968771b6727bff0120490f64381d12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648309884, "uuid": "e79d8d78-6e23-4dd8-b8ba-177d2325489a", "comment": "Malware payload (SnakeKeylogger)", "value": "51786479a7046d306ce763fb2e45aa2e88fc3b6e35dbf749486c02143f863d87fd8114d758e981f56360204eab2259de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648309884, "uuid": "401c0c5b-d278-4ed2-9dfd-77b973592f25", "value": "T1F325129056614F8EDBBC87FC0CA2815CE3BB7C2A9431C54DDF88B98A173639D56F052A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648309884, "uuid": "d3ab93f4-e8b2-4806-b102-3ff292aa0971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648309884, "uuid": "d0448673-a5ff-43f9-9cd3-1efeaff09b11", "value": "12288:YEEwEiiKBX4TboNWB6dGMP2X+3T36cf0Qugpiut5NlVCZqGS+COdue9d3IiEjR0O:YRw5fgGWQcu2OLHuQiut53aqcXJGRbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648309884, "uuid": "dfd6cba4-8fce-43f4-b398-8c10f01e61b7", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648309884, "uuid": "5bee6e98-6171-421a-b4be-4ef8b9c97cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648309884, "uuid": "3ea8eb4c-5ec0-47ff-b561-56c673d8efbd", "value": "SWIFT 48,000 USD payment.PDF(101KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b34121-ad2d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1648316943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316943, "uuid": "086be255-7c3d-40aa-965a-6bc58591d409", "comment": "Malware payload (AgentTesla)", "value": "401276432131bf6c2dc948151c5fa716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316943, "uuid": "98bdaf55-b0af-47bd-b0d2-613caf3a2196", "comment": "Malware payload (AgentTesla)", "value": "4076e4d9942f9a6cb670061dc63fe4ad30818c8b2c3f45888eb6950a91088b62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316943, "uuid": "84d5c619-86bd-41bd-a459-425a46eaf4f0", "comment": "Malware payload (AgentTesla)", "value": "b29b297f0965ad344d5681348a522aed88d9ef89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316943, "uuid": "28103ab4-ac5c-4727-a2d6-fd01239017e2", "comment": "Malware payload (AgentTesla)", "value": "987cbec5348107833511e22c731f3052d12cbf7d80a9a8d1b669d1fe056ae612ead531c707859ae4e2411d906a46c9f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316943, "uuid": "8155afad-62c6-4b28-bee0-c74d6a8b67a8", "value": "T116D49D72D3F8AF97D53D93388031841677F5D922E328CB4EBEE910C65892B824736B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316943, "uuid": "9db58847-e1a6-4ea0-8d57-72137da8c2ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316943, "uuid": "18f7d77c-94b5-4f3c-9561-775d526ed6dc", "value": "12288:N9MNYF0uDGqoVYpPdC9wED2TRrLhftm8nD7lg2gmqno07jTn37aey/gKMQe:NyNYF0uDGqoVYp16wD/Ntmsn+Fry/ZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648316943, "uuid": "7427bd25-c1cf-43f7-9361-5e660881670f", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648316943, "uuid": "302b1413-c013-442d-b1bf-6304b5d12b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316943, "uuid": "20e1e64f-6725-434c-8dc5-fa8120ee500f", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48442127-ace4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648285700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648285700, "uuid": "4c4e34ab-e499-496b-bce8-a289bddc66fb", "comment": "Malware payload", "value": "92ef72f6879bc9dae21938d9e3025913", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648285700, "uuid": "25f0138b-3581-402b-9abc-acfb1e9cb677", "comment": "Malware payload", "value": "40c5d2b4c34b78578708e9661512cb3985feddae4e910fa8dc4373751b8e0135", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648285700, "uuid": "aff45324-2e9b-4a26-b82c-327d35f9365a", "comment": "Malware payload", "value": "3168279d432f9e20d534244a5907010bc809351e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648285700, "uuid": "5a045478-be92-4d11-b366-a630c0944b1d", "comment": "Malware payload", "value": "fa1ed7571a4c4786886e109677859fcca5519e1b65a36a4161536cb8ccec41352f39bc2a94fe2a7891e0bc48bba28701", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648285700, "uuid": "b2de68d1-3860-476f-afb6-b902bfed023f", "value": "T14CD53322899DC83F80F68B5FD6E17424AC558DB5898442E3EA075900E12DE4B5BBFB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648285700, "uuid": "b8c5adf6-bd9f-4824-bba4-925a2f3a935c", "value": "49152:+1roPzyEdPP9kCP+B+8sdL/UqZj7am70TWubyQrK6q1C/gI9O3qUVUxWjxvS7:+1roPzyEVyS+B+/djroyQ6EIIE3qqOeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648285700, "uuid": "868570c9-4433-46a5-b123-5aba6d765ca6", "value": 2965139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648285700, "uuid": "503cdcbc-a988-424f-8ba8-46b7282375c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648285700, "uuid": "085595b0-dc38-4e3e-95a7-6ddac3229bec", "value": "92ef72f6879bc9dae21938d9e3025913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a680cce-acef-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648290401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648290401, "uuid": "fa2b60f7-a849-4b4b-bfcf-fcde4ce12a0c", "comment": "Malware payload (Heodo)", "value": "e3ec48c6311554553e67170cd5fb066b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648290401, "uuid": "85b4591a-d1a6-4750-b326-562e96a8f7a3", "comment": "Malware payload (Heodo)", "value": "418917f6a8e76ffee80ab30ce9a27a5c9e3681c98754d70d3417f54093024ec1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648290401, "uuid": "3bdc4f95-91b0-4c71-a598-63a630b95917", "comment": "Malware payload (Heodo)", "value": "386cb3ca2f8a1707b9398a0f3c9403fbc1a68b78", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648290401, "uuid": "13392cba-a1c3-46df-83be-b4dc7b12db8b", "comment": "Malware payload (Heodo)", "value": "c570b49fade0fa7e49903c1d7bdd77847ca92739b68064d727b0613d096fba0b34cef32f9a706decd2f003c4900e7941", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648290401, "uuid": "117e4623-b999-432e-a971-bbc70e06da28", "value": "T149E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648290401, "uuid": "3c903ca2-7aef-4607-af5f-5d1d71c9af34", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648290401, "uuid": "de9713cf-d675-4ac5-ad76-5c9eaa53c4de", "value": "12288:jc899XKPmN4WMko66ZPJSFTdtXlcIL9v6O8:7GP7ZgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648290401, "uuid": "3aa62b87-075c-4223-b302-28ab077c6a32", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648290401, "uuid": "d403b7b1-fac0-477e-b1f0-d69e45dae80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648290401, "uuid": "aa512e5b-2020-44ed-81ee-19a5b75646fb", "value": "emotet_exe_e4_418917f6a8e76ffee80ab30ce9a27a5c9e3681c98754d70d3417f54093024ec1_2022-03-26__102635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0a0cbd-ace1-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648284341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648284341, "uuid": "a6cb3ecc-4df2-48a9-9e9e-3f40a398da9a", "comment": "Malware payload (AsyncRAT)", "value": "733b8c8bc64f965c6859aca8dd46a1ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648284341, "uuid": "1df48d4f-81a6-4352-807c-4a4313dbfd7a", "comment": "Malware payload (AsyncRAT)", "value": "474661d119205c20e4e63d68184852b8b4e0b22650b2685631391f19969ca053", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648284341, "uuid": "f52d103e-5edb-4d4f-a10d-99d26eb38550", "comment": "Malware payload (AsyncRAT)", "value": "de67ceb5ee5349ace23939afbfe68fc97af6841e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648284341, "uuid": "9c8be4f2-a282-4482-9683-696f92125cb7", "comment": "Malware payload (AsyncRAT)", "value": "6ad948111b0982035d45fe4776f080d491ba10c1f04822469d052939dbde6a81ffa1b5e4c630aefce748305041eb92b3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648284341, "uuid": "3df51eb2-fdfc-4468-89a1-029814a918cb", "value": "T173232A003BE9812BF2BE5F78ACF26145867AF2672603D54E1CC4429B5713FC69A425FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648284341, "uuid": "c1349f6f-2282-423e-bf30-45fc479f73b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648284341, "uuid": "9a63ad9a-7145-49c2-8e5c-ca493ad42586", "value": "768:auNO1TtADT1WUVxJPmo2q43F4wmwegOPIFzjbwgXriEwlJ1jlzZ+7yksYBDZvx:auNO1Tts72XuO3F3b3XmDi1dvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648284341, "uuid": "d59d5515-071f-4fe3-b1be-220bd398dda4", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648284341, "uuid": "e664164c-51a2-426d-9a0a-c80d4ef88980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648284341, "uuid": "33fb4702-b49b-4052-b5a3-424c70f95524", "value": "testowiron.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0059edc6-ad09-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648301471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648301471, "uuid": "48197668-88d8-4db3-a631-e7cdebf3937c", "comment": "Malware payload (RedLineStealer)", "value": "c66cbf8b3a2acf348b733aa5a0edcefd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648301471, "uuid": "699d6a27-d38e-4c8d-aef9-59e0be5d0105", "comment": "Malware payload (RedLineStealer)", "value": "48ab5fd5fa205ebe4511fc65a7ec85529b67a45b0cbdc2c18008901e747dca7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648301471, "uuid": "8cbdd2cd-6a6b-45e6-a298-8535bfe6df33", "comment": "Malware payload (RedLineStealer)", "value": "8824b9c3efcdad992bbae5631eafee5eaef7b5f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648301471, "uuid": "809ac1e9-4893-4103-9ea8-b7f8f69547dc", "comment": "Malware payload (RedLineStealer)", "value": "87f0a5a9bc34f0a0d4f273d965c7bfbc475be486528347ffb5191b560a2ee406b0b53e60ca8c9ba6c6505e764879c568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648301471, "uuid": "4819fc8a-6902-4ae4-a671-c2275a87b182", "value": "T123A502E6F2EAB26EC1D612B010F0B5020CF0CD0A915BF7EF69B79495741A1746B1AB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648301471, "uuid": "e7332ee2-930b-4ff4-a108-1076979d54e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648301471, "uuid": "dad18749-788b-45f6-8fac-6336a62e7ae8", "value": "49152:o6G/sBRt12xyX1OXNymsveLxgfNR/EPm1BCwFh2afm:vQXN3svx1R/E03v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648301471, "uuid": "fb93b795-1a67-41c0-a90d-628a09eb313d", "value": 2123776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648301471, "uuid": "41b9e40d-7b89-4bc0-9a2e-c90ee37379e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648301471, "uuid": "7ef5793b-ba93-44b1-9d18-6380a6b5551a", "value": "c66cbf8b3a2acf348b733aa5a0edcefd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d2190c-acb4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648265290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648265290, "uuid": "32c8b40d-8bf7-4bbd-a830-09452c13a92d", "comment": "Malware payload (Heodo)", "value": "eea1d2c51cd7e0b23d4eb17bea3f221b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648265290, "uuid": "9e4befbd-a65e-4caa-b52b-654f43954dd2", "comment": "Malware payload (Heodo)", "value": "48c517b2eeaa166b1ee7b5342b30f106a3f5ccb1548d04da6ec2e5beb3896b89", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648265290, "uuid": "dd2071d5-a67e-435f-bbc8-dba69edf648c", "comment": "Malware payload (Heodo)", "value": "2a6d472127af4b228e4adedef4fbe307dcb52966", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648265290, "uuid": "37e2b53d-0b27-4d1f-a3dc-f3854235361d", "comment": "Malware payload (Heodo)", "value": "b2ee044af459579fb04409a4f2fb93fd816b2b8be4a29ae3db30e02ed8cabf7c28c9e2410a139b8944af1fd6dc6c72bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648265290, "uuid": "836652a4-88f3-4619-9d68-4663a4f5bdf1", "value": "T195A41994B352A538C4DB3CF839499296629D5CBC37CD71F67BBE41AD2B64DB0233120A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648265290, "uuid": "1ffeab8b-e1f4-4927-9118-1dd496b54c42", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648265290, "uuid": "351f8497-273c-47e7-ab6a-e3c9b4d29531", "value": "6144:CdM3bZVML7K0f+5zhHHq9xT+cVXuP1kbD2gqKRGq9roIt76Ghx7TuN:C2Y7Kg+5zhHHq9xT+oDWIGUcItvhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648265290, "uuid": "0af34f5b-e449-4bef-8ab3-8e4570e2d7fe", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648265290, "uuid": "4e9a18aa-d26f-4aa3-8a16-38f6e7b396f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648265290, "uuid": "c585081b-b0a0-4ee4-928d-b2d6b7564a46", "value": "emotet_exe_e5_48c517b2eeaa166b1ee7b5342b30f106a3f5ccb1548d04da6ec2e5beb3896b89_2022-03-26__032805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a740a6d8-accd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648275981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648275981, "uuid": "4637c673-1de4-4f43-a272-7fb03b9af1bd", "comment": "Malware payload (RedLineStealer)", "value": "714e5113c2f5dfe74c1a16693fa79b29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648275981, "uuid": "5e4dcebe-212f-48ec-a9dd-69c5c54fede0", "comment": "Malware payload (RedLineStealer)", "value": "4a07a70731fe916d377888b49ac5bb01dac3f32a48a6311cd8fd616d9082cfa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648275981, "uuid": "86859b08-ade9-4abf-9831-34f434403230", "comment": "Malware payload (RedLineStealer)", "value": "f54a2295866edd6ddea04526a23589764b96e88a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648275981, "uuid": "9fcacc46-939b-4fa4-b5c5-142746659007", "comment": "Malware payload (RedLineStealer)", "value": "ddd5b9920540570d67450e68e973f58334317ee2c6d3252a867878c6f6d1af45dae6c0d8c47c20484cad0741b6262d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648275981, "uuid": "b8b08c10-43ff-494a-8501-8dabdd79f4ec", "value": "T12AD423C3A3C475CCE24F67F79712DBC9A69B672985DC309282C8CE0F964D9D136284A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648275981, "uuid": "ce1cb023-2975-4bd6-afae-755d4165676d", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648275981, "uuid": "6595cde7-d05f-4937-8f80-566c8833b1c8", "value": "12288:yWJxS/d+3ndt1zkchIkzO7QS03ULaHNqrxlKIQNoEu0go9MxzS7:yW7S/dktBhI37kEaHNYK3jLCxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648275981, "uuid": "1ca3dd29-c507-46c7-9886-7cff91eb3f5f", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648275981, "uuid": "64842910-0ae3-42c5-bbbb-27ef89cb81ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648275981, "uuid": "c2de12f5-3d29-43b4-9997-bc69c4d7f38f", "value": "_@vasyapupkin198_crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d931371-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648268851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268851, "uuid": "5f128e7a-446e-49d1-a7c6-5f1612572e1a", "comment": "Malware payload", "value": "f37c7d5fa69ad187235a162203eacafd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268851, "uuid": "55ad97ea-4570-4936-bbd0-d0029da78b2e", "comment": "Malware payload", "value": "4b2ff97ccb7034b07618bf9fc3e8935c233a564574ad1629280bf39e7dcb5ec3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268851, "uuid": "dd25f944-707d-4b56-aaef-d20d16cbe1a7", "comment": "Malware payload", "value": "970f5aac456ac9e403c445bbf9eae084019b9b46", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268851, "uuid": "80487f4c-63ea-47e2-ad70-827a71001607", "comment": "Malware payload", "value": "7dabf6e29b77ac35989ea44e7526659b39c7807f3ac272871a5f5faa539ed095423f016f91abcafe58366347d852f668", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268851, "uuid": "7fa27de6-0920-4fb2-a8ed-b2d16eeaefc9", "value": "T11166233372690185D0EDC53D8E37BEED35F2132E826258F9BC955ECA3149EE0A603997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268851, "uuid": "2ba11798-3bd1-447d-98dd-17e939365862", "value": "ce881f62e54bb9b9c720f6ce57186321", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268851, "uuid": "918d0713-989e-4c95-bd03-3129daab63e2", "value": "196608:JXj9MVF8wMg+A+ClOFWpqnhX/x3fTeIxe7tF:JNg+AVhkhXpPTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648268851, "uuid": "55fbea16-fc37-4723-b5f3-c529fa4d66cc", "value": 6532096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648268851, "uuid": "6a7115ed-b3d6-4a25-a7ca-d4e7fb776a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268851, "uuid": "35aae127-baf4-4b1c-b3b0-adec8d3db846", "value": "SecuriteInfo.com.Trojan.GenericKD.48713704.16555.7039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc76cf1-ad0b-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648302673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302673, "uuid": "1472506f-1653-401e-94e4-6302bff8a71d", "comment": "Malware payload (AsyncRAT)", "value": "f732a2afc52f86e1bda36550f5e46b3d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302673, "uuid": "dea023b6-b050-4a57-9209-7faf2fde9da8", "comment": "Malware payload (AsyncRAT)", "value": "4b43dece54a2995bfcbb99258d82f8afb2adf6c52ebf64fc2acea68e108164f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302673, "uuid": "35467e51-1f41-44b5-bb91-938a0a06daaf", "comment": "Malware payload (AsyncRAT)", "value": "b5ea929bbe79eb9f33fc9552f915c48c3685650c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302673, "uuid": "4b4d02c5-d831-457f-8394-95c1625281a5", "comment": "Malware payload (AsyncRAT)", "value": "b835777d7ec4f23d045282d2fe99ca65b4c2111a78c8ccdf4ae6f06796b1fafe157c008d668d19038e835ac1433fc829", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302673, "uuid": "95837428-e5ed-4a4c-8106-954e51740195", "value": "T101B47C71D2F8AF9BD53D93388031441677F5D922E334DA4EBEE910C65892BC24B36B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302673, "uuid": "7a617132-cd64-4db3-9356-84186814a2b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302673, "uuid": "579ad06f-c855-4734-9e59-a36f6d88c8fb", "value": "12288:ju1Y3UwRGEuVYpdH9wED2TwA3KLb0yuyjUPZvJ:ju1Y3UwRGEuVYjdw93KX0yFjUlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648302673, "uuid": "8224fe7b-ecff-46a7-ba7e-c9eeed4ecc61", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648302673, "uuid": "e6bc5528-3c8b-4135-b183-2ad829638c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302673, "uuid": "66b92972-a3b6-4065-9a69-c84b99186676", "value": "8ctx6R4pWO9beqW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a98fac1-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1648277141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277141, "uuid": "2524f7f4-ddf7-4046-a1fb-a8668aa07470", "comment": "Malware payload (HawkEye)", "value": "da6e54ae259955fd02119a10e5772e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277141, "uuid": "4d35c723-4d70-4a31-949f-108457241aac", "comment": "Malware payload (HawkEye)", "value": "4e20a72f2791a602f8ee9999765a9365729ff929da4d5fa6be7bfb4c20e9989e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277141, "uuid": "3148a481-1a0a-4736-b362-0efb5d4a8d69", "comment": "Malware payload (HawkEye)", "value": "36ca19aafe405186f1f3414a091df614626d9781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277141, "uuid": "0ddf7819-1bb5-45aa-84e3-ccd38dcc27d3", "comment": "Malware payload (HawkEye)", "value": "2ce3745ae5bef4a7bdfa93fd2a40a7d4ca65e97ecbe762c14383012321831489668d432979c9e46fcb50d1aaa4cc4e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277141, "uuid": "9b42deca-063e-4a45-86d9-e88895ba95ab", "value": "T12F951213735DC661C0665B7348FB86002BB26D4B9AA3D62EBC8477DC14667C34B13BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277141, "uuid": "97c51459-f309-4d4a-a958-2def24020a5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277141, "uuid": "b159f21d-ad9c-4c10-b51e-76f60bd6a15d", "value": "24576:JNIHu1Fc6zae2faZr8p99yG6w6Zinvn9H52Eoqoah05/LbDBIlc6MQH5l:VnLfraDz6Z2nt52EokhqONMQH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277141, "uuid": "17d0594a-6b52-42fc-8fa0-518829e03505", "value": 1935872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277141, "uuid": "f21764d5-35f5-467c-be2b-3985585ee7d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277141, "uuid": "8ef28523-56f4-43c7-9719-0f680ccaccc0", "value": "Payment slip.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca43fabf-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (Babadeda)", "timestamp": 1648277328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277328, "uuid": "6c52cec1-1f8c-4a72-9dd1-13033217a4ec", "comment": "Malware payload (Babadeda)", "value": "69a5fc20b7864e6cf84d0383779877a5", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277328, "uuid": "e8678814-d3ba-40f5-81fa-c6f9859b391d", "comment": "Malware payload (Babadeda)", "value": "4fe08cc381f8f4ea6e3d8e34fddf094193ccbbcc1cae7217f0233893b9c566a2", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277328, "uuid": "dba6fe83-52a2-41ef-b0b5-f637f3f9b0ec", "comment": "Malware payload (Babadeda)", "value": "6c31649e2dc18a9432b19e52ce7bf2014959be88", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277328, "uuid": "4073e521-15cf-4549-b4f6-da09580eab22", "comment": "Malware payload (Babadeda)", "value": "82806aee788c11c5581ce35787ffc9a2b0153b907c18d99a4253fe5f0de226ebb02073eac3efe0ae663923e49217de33", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277328, "uuid": "c59f62aa-4a79-4bb4-8ff7-6ac2b40e6ea7", "value": "T1A4936D41F3E202F7EAF2053100A6726F973663389764A8DBC74C2D529913AD5A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277328, "uuid": "34e0cb63-750a-413f-939b-424eb9994242", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277328, "uuid": "6db59ed4-b5e5-44f3-bcdc-56d1f39d3b42", "value": "1536:/7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfawrOw:z7DhdC6kzWypvaQ0FxyNTBfa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277328, "uuid": "49d70082-0ff0-41e5-8f91-4f76cae7bd97", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277328, "uuid": "7fc0661f-723d-4c2f-9068-e6882b5cc282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277328, "uuid": "b3ca4d0a-8928-4349-b4d6-628b3e42e916", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4217b07-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1648277318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277318, "uuid": "17d56a12-1c68-414c-b091-7cbf4c664408", "comment": "Malware payload (Loki)", "value": "2abc31cdb96d8ec370a68f4cb1000528", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277318, "uuid": "3e628cba-4f75-4f36-b544-07b15f0eda2e", "comment": "Malware payload (Loki)", "value": "549e72fe38a8078d752aced9592b2a5c14406503eb235571e66df96e2bf96de1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277318, "uuid": "cd9016dc-b595-4803-9998-1b87801cc42a", "comment": "Malware payload (Loki)", "value": "5a0e393108d69348243b7d4ed31bc6d226b99829", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277318, "uuid": "4522830b-3207-4685-9ccd-45c331860a11", "comment": "Malware payload (Loki)", "value": "094825fb566cd34971f35634669c324611fe25d41ac63503ba21cd9ccc72ae3a20af42a5f7abdf8874be2101ae9a2bde", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277318, "uuid": "77e774d7-db9a-4c9f-ac4b-a560127d9d1b", "value": "T1FA14021CF90C8DA7E835A9B059E3D3524226EC05C6BEA29F7199B733753AF5D38103A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277318, "uuid": "83345b9b-d986-49be-a8ab-474d51e72809", "value": "3072:ZnBUVM+kHWsxWyhhCtF6ow8+AMthOxdxbUkODM/FGKnTCUoGrWTgT:hBgMKs9hCyBA7bUkODMoKWlK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277318, "uuid": "b2508ed8-cc9f-4ce0-9bf4-8535e548d58d", "value": 192104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277318, "uuid": "6450b4db-e2e0-4dea-9c0c-c49166e11abf", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277318, "uuid": "90f5c003-b0e6-43d6-a211-9d74c6643366", "value": "ANS\u00d6KAN OM ERBJUDANDE EUI894MD5684633.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563bda0d-ad25-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648313641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648313641, "uuid": "1df7b7f3-a031-4ead-be0d-cecbb17f6f93", "comment": "Malware payload (Smoke Loader)", "value": "8127c40298b6eadffe264a9ec83b51f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648313641, "uuid": "e743f68e-2a05-45bd-8fe6-24fe585bdb32", "comment": "Malware payload (Smoke Loader)", "value": "54e3ee54fac434e25c03ded56a4680f1ea40a245d657440ac9c51be7f27ef656", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648313641, "uuid": "402810ec-e891-4711-82ea-43d18e3620e0", "comment": "Malware payload (Smoke Loader)", "value": "739f66d9f1b4851daf7a297adc3ac541cbd935b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648313641, "uuid": "fe369ee9-1420-4cb9-9453-5319e322a9c9", "comment": "Malware payload (Smoke Loader)", "value": "7a992affd7827bc772bac4cbf32f80c4319c46f77f165bced46507a388723632948a82f059811c25ab840607301733f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648313641, "uuid": "9dd15ee9-c388-4b18-bae9-d504f522b64f", "value": "T17824C02236D0D032C45712367465CAB42EFEA83117660A4F77A94B7E6F303D1A7BA74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648313641, "uuid": "26352f22-31dd-4628-b0a2-c811629e2a2c", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648313641, "uuid": "fff9972e-a6b0-4772-97a7-97e5aa8f8cb2", "value": "1536:hGKDWND9TgtdAGkDh2lrD0OCsPOcT/X6QEd+KBzmrdVJGF5KBkM45mXtYz3B:hGKDWHuCbwZRdVJGF5EkJ5mXtYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648313641, "uuid": "bb89e1bb-81c1-4293-a4b5-0ac029910807", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648313641, "uuid": "f43c6cb6-f316-4363-9ae2-d8f6845e7551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648313641, "uuid": "17f2eaff-68e8-4b20-951a-d9b99a3a79a9", "value": "8127c40298b6eadffe264a9ec83b51f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c172de-ad0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1648302153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302153, "uuid": "c87ea77e-a62a-48bd-803d-2f8584b52d45", "comment": "Malware payload (Mirai)", "value": "25fc87e7d1cbdfcd38a5ffef3d89ac2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302153, "uuid": "a7746eba-39c0-4d14-ae1b-82c5c1239125", "comment": "Malware payload (Mirai)", "value": "577e4c88147d308c8b0260d3252fb3ac450a7478ca79b2d2874019b70024b1e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302153, "uuid": "5439cc33-7904-4e53-bfcf-0090c2ef3b4d", "comment": "Malware payload (Mirai)", "value": "7264425a3169d028d3093e4f6ffc6f917a25288b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648302153, "uuid": "186d7c59-85a2-4dd3-b682-29370e84118e", "comment": "Malware payload (Mirai)", "value": "3d0971a9b9a5a3287e0a082f89e4407090bbb36801fa5130b2beb64f0fe1023520581be1b0a5ce7ec8b7bafffea7dd83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302153, "uuid": "64da75f7-cc38-4e0b-bc8a-e85769e1f771", "value": "T119433921AE7A291BC0D8A57B52F74324B5F1634E34A8C71E7C220F4DBF55580A2A76FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302153, "uuid": "438dca7a-95a6-465a-a502-f07ef7247b06", "value": "768:54Ao5eKpKj7lws0hvrzE4gNhWGHckxpXY5/LK8O+Ldqp17eUwSGv:54AieKpKj7lwXhvE4gNhjI/LKG5w7eUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648302153, "uuid": "078148c4-628e-44ec-99cf-3d85eac1ebc0", "value": 60552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648302153, "uuid": "6896f5b8-57f9-4c32-945f-d19d69ed1b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648302153, "uuid": "4d1e0334-9cf4-42ff-99f6-76ab83d40760", "value": "25fc87e7d1cbdfcd38a5ffef3d89ac2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03c82ca-acd3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648278654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648278654, "uuid": "8bd5610a-3c26-43b2-899f-90797cbdc855", "comment": "Malware payload (RedLineStealer)", "value": "3516f6cae47d318527ba2a24391edf43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648278654, "uuid": "f8bcc58b-6a32-4ed4-8642-fd19918e687c", "comment": "Malware payload (RedLineStealer)", "value": "57d2f478356b21d798ab32c030fe0fe8cf5ddd0ceb075b259090813558b6abd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648278654, "uuid": "adb96067-a2f0-4051-9d5c-7339e246c8b0", "comment": "Malware payload (RedLineStealer)", "value": "cda159e20558c20d567f8745e30cb0dcde34e260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648278654, "uuid": "b4087c3e-24f8-46a9-be3f-e5ffdf5cdb08", "comment": "Malware payload (RedLineStealer)", "value": "952323b372c9fb77308a6e83437e189325d7f766021b4a0263670c47dac354d877eab6ea152c200e6cde44b5c6e84ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648278654, "uuid": "36b04f5c-cd7b-4417-9866-42b22f4d4bbf", "value": "T1BED633997520DBE55AF7DAFE11BD6B61A5C00FE3F85ECB6A60421B0CD1F8CA09504E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648278654, "uuid": "5e55001b-f48e-41f3-b664-51bee7982652", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648278654, "uuid": "9d2a35f5-976c-4646-968c-1dd6a440df07", "value": "196608:tkU4bdv++0Yc8/KyJJfWM0tdJA9yzuap+Gjg:rovSsSyJJfWM0tA9UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648278654, "uuid": "86fb7b79-e4b6-4209-aa2b-3cec5c075601", "value": 13822464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648278654, "uuid": "39132545-6041-4afa-984d-301a5753ccb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648278654, "uuid": "80c4fee6-913b-4005-8b36-6377eae517a2", "value": "New Project 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb98e80f-ad1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648311234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311234, "uuid": "7ed565c5-395c-473c-bc7e-4286a05644bf", "comment": "Malware payload (Smoke Loader)", "value": "0ee743f091dc8e3f4bf51c72b4ff4e0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311234, "uuid": "a730eafd-5ee3-49af-bbe0-8fb9f3c75889", "comment": "Malware payload (Smoke Loader)", "value": "58bb54de7a3ed504f85202b0cd55ac2da9fc821b5695aa854703f885cd80b044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311234, "uuid": "d420c8bc-3045-4362-9c0d-4741854e425a", "comment": "Malware payload (Smoke Loader)", "value": "0975002b8d30ccabd1bf237f29adb377ee7db817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311234, "uuid": "b3666188-bea6-453a-bc5f-229dcd17db08", "comment": "Malware payload (Smoke Loader)", "value": "26e23449e0298c62332107a7cc4c1c2fe1d6cd47d7eae1250c73089f785f132b3d6fe5299ba1d8a12a042dbf38bbaafd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311234, "uuid": "5f8660cc-fac0-4729-b535-aea726a2e9dd", "value": "T10224C0113641C7F2C417403938A9CBB1662EB53D27625A873B8A196F1F3D2E247BE74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311234, "uuid": "7770fc1d-2a97-4e5c-b48a-f32e7de3d4f3", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311234, "uuid": "6705506a-dc9f-4d35-9e65-dcf339fed9dc", "value": "1536:+EK//EZQbDaa/1pgPXOCHWs5D00rboVAQx6Vi5QRc6vzwj:+EK//EG1vIVfvo5U05QxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648311234, "uuid": "ac7680af-4065-47b6-8c05-d5b906928635", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648311234, "uuid": "ce60cbe1-555d-46a3-a4f0-2b4584a94019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311234, "uuid": "46a656e0-baac-49b6-bc6f-fef2c0ef2d5f", "value": "0ee743f091dc8e3f4bf51c72b4ff4e0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61aeb288-ad5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (DanaBot)", "timestamp": 1648336853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336853, "uuid": "04fe9015-0ad3-4fd0-9be9-264560447375", "comment": "Malware payload (DanaBot)", "value": "4a2e125416559fdd8e8a8682dc901614", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336853, "uuid": "e427f262-0033-4030-a573-fc50c3fb049f", "comment": "Malware payload (DanaBot)", "value": "5aecb2a5bc5447dc736c29882193fef4f2b007299a1817c664e1ba6a028363cf", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336853, "uuid": "a3cb0fd1-8b18-4bc5-9930-3bb7d62e2b62", "comment": "Malware payload (DanaBot)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336853, "uuid": "b26d9604-0344-4954-8691-b6b4aae9de21", "comment": "Malware payload (DanaBot)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648336853, "uuid": "990d9ba8-616c-491c-92b6-5459fae4374f", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648336853, "uuid": "ed7b419f-b584-4d41-a593-9ea094de0c82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648336853, "uuid": "599853ab-60e0-4157-a6e8-6acf0d13cb09", "value": "4a2e125416559fdd8e8a8682dc901614.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6af509-acb3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648264721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264721, "uuid": "a7cc595b-57f5-40a6-8ece-5086c076b56e", "comment": "Malware payload (Heodo)", "value": "2d4bd9c3ad0740a56af5cdb520438449", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264721, "uuid": "e968d7f4-c32c-4559-819d-7f9303dc6b0e", "comment": "Malware payload (Heodo)", "value": "5b08bd769d93d11091083f629fd0b67b603a81ca7377fcaae7f9e587b3a073d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264721, "uuid": "2b708358-e570-41ef-b225-96dcced1a8ff", "comment": "Malware payload (Heodo)", "value": "afd3f701833051d133d0cba447e8f37aa6203321", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264721, "uuid": "550b1b78-676c-43ad-9395-daed31e2e690", "comment": "Malware payload (Heodo)", "value": "fa5f3870d9ea67ec87c9e9ed00fe3740455dd1d2fd5f99c058e0c4fe71a59641d392d4f9a010890eb0372ac9c7550ecd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264721, "uuid": "74f26b75-a90c-4619-b12d-7da5560d1584", "value": "T18B94F5A35BC3C077E45B02B9C65A5118B257C632375AAADF37C2671ECA3C3A2B738151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264721, "uuid": "b518f993-41c8-4813-bf78-3f306430d671", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOZ:w5aZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648264721, "uuid": "24fd3301-962d-4af7-a859-7b3ca5870300", "value": 416056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648264721, "uuid": "901db58a-146a-4ab6-a434-6c4a8195b4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264721, "uuid": "90479fc1-cb06-430d-ab6b-d1fb66a51623", "value": "emotet_exe_e4_5b08bd769d93d11091083f629fd0b67b603a81ca7377fcaae7f9e587b3a073d8_2022-03-26__031836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2aed482-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648310763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310763, "uuid": "4b178c8f-5ac1-4041-8ac1-44c2ab69f1f8", "comment": "Malware payload", "value": "d2b5aea0311b7f0d978dab18ed8b32e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310763, "uuid": "586a7f18-bc50-4c70-92be-69405d7effc4", "comment": "Malware payload", "value": "5b38e30e7d72f6d40da18b1d3dc43358fc2dc9ffa21d2054a8937802a70f0223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310763, "uuid": "dfebef8d-9581-4e57-8561-dffa06d0401f", "comment": "Malware payload", "value": "55a49d83ac5edfa48cbc45a6ddf8320c4397a5a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310763, "uuid": "48e2d527-1b6d-46c3-ad74-7564005d4422", "comment": "Malware payload", "value": "7cc7cab3d76b68c0d0c5dd7e13eb344595e66e57ddbc318f40add1ba906f734a62f39b4e5693aae3a7016f494cbedddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310763, "uuid": "45f8bc81-998f-47ce-aaff-2b62d4c08f22", "value": "T199463326F9356890C4B866FDA90773D4E03912CC63D1F8DD7E8818DECBA32D5681E789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310763, "uuid": "37c3e678-ea24-4bbe-b958-9a86bc732968", "value": "cd4e286f12b8f0804939a4978b0bf1ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310763, "uuid": "ebbefb36-8960-40cc-93eb-42f9c03d0bdf", "value": "98304:5NnAMWh1JSsp0oC0kZL8AUewZ/baRwanCxoSERgUEdqxYseHhPzgVYkUUhgK4:5Nn0h+sp0v0k5bp62RwanCxjU5x+baJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310763, "uuid": "52570ab8-b629-4a06-ae04-a391ce67a9b7", "value": 5512273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310763, "uuid": "69c5046c-5895-4a53-aa74-848783d04eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310763, "uuid": "d3938cb8-3fe3-4c4f-adf3-76f68c05323e", "value": "d2b5aea0311b7f0d978dab18ed8b32e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7653aa0-ad55-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648334393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648334393, "uuid": "1463562b-79e7-40a1-83aa-23cc239d4196", "comment": "Malware payload", "value": "2c44b4e4706b8bd95d1866d7867efa0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648334393, "uuid": "0dbb9f68-bb5e-43d1-ab9f-d77bfae46263", "comment": "Malware payload", "value": "5d2530b809fd069f97b30a5938d471dd2145341b5793a70656aad6045445cf6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648334393, "uuid": "ddadec16-62b4-4ba0-9e79-9c728bde7472", "comment": "Malware payload", "value": "e545ceffc8948e3ca9900212807cf3a862d33581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648334393, "uuid": "19667130-f0f0-428f-9fb9-b1faeb124bf0", "comment": "Malware payload", "value": "5011915bf9a48a496e72602bed6a318bed67708f30db20ec0501e3f3aa47fcd456a09fab9732569fbd89d679fe63cd26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648334393, "uuid": "ff0bd436-21d1-4c55-a1d1-449dc10123b8", "value": "T1EF562B16FCD604E6C5BEF1348692A322BA7138B7833577E35F909A6A1625FD4793E300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648334393, "uuid": "4bac98f8-9e4e-4a94-ae0b-42ea4074566e", "value": "49152:ElkHj6y06V91YFQ4zc8qTZo1fWHHt8cQ5Y//TJbWDeIarRwAhWnt8o9tsOJU5N+A:WwjD06Ilzc3ZYWQ5Y//TsLlWAtc+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648334393, "uuid": "c75d3c42-a559-4798-af3e-46dd1e2b7cd5", "value": 6316032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648334393, "uuid": "9094a43f-6a5e-4764-9ed4-adee950de05f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648334393, "uuid": "f6449392-ded5-42ce-be61-2060225ed3b4", "value": "kinsing", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19feb4c-ad33-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648319834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319834, "uuid": "fc1b01c5-66b9-4ce2-8f4d-395d47fef5fe", "comment": "Malware payload", "value": "b599e5b4ef005d2839c853f97502abcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319834, "uuid": "a43d3067-45b5-4bc7-8002-5a402608630a", "comment": "Malware payload", "value": "5d85e1cb9ca315fada013a2fcb75c8aec155282a7a246127f7ecfa58a71cb3bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319834, "uuid": "dc9bba63-c08e-4186-8690-f1d0b1d5e95d", "comment": "Malware payload", "value": "45238c89ec5e4ff82e93dfc4aeca5108ccf8d914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319834, "uuid": "388cca1c-8705-4f0e-be53-5c564f122958", "comment": "Malware payload", "value": "4342be5df532991e83dd3280ee069da848b17743808e392feecbf93001fca185958b803b54310bb00f2664b5d4ffdf16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319834, "uuid": "366e8a13-c2c1-4860-8c65-1172f08a86b3", "value": "T13684AE68E33A011AE85CA331F1661542C11463352AED8A457F9BFEE097DC50FF2E936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319834, "uuid": "75564cf1-180a-4716-996d-cd8a8020938a", "value": "3a2003ea545fe942681da9e7683ebb58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319834, "uuid": "594e4b6a-9ce8-40f0-93dd-9ae0faf4b085", "value": "6144:AjlYKRF/LReWAsUyMSbhdDnnNbEBypaNhXgTMsbUwRGTs7cot+:AjauDReWPDnhEUe8RGTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648319834, "uuid": "ac663aa3-1021-41de-9a6c-0626d3c368cf", "value": 404870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648319834, "uuid": "67ee6d9a-920e-4098-b559-34ebd6da3011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319834, "uuid": "1d925be9-ec6f-4b3d-82cf-68aff0120622", "value": "generic1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc5a142-ad1d-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1648310377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310377, "uuid": "0287ab50-5041-4946-90f3-e00099ca3038", "comment": "Malware payload (CobaltStrike)", "value": "f3b33d5bf9d6f3b2ccd0a670424fa7ac", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310377, "uuid": "3ff7b27f-0b7e-406b-9738-1954a36c8199", "comment": "Malware payload (CobaltStrike)", "value": "5e2a11b6d44e66396f0ee23ead9dc4ccb4eda0664bbc097088bfa8fcdb200335", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310377, "uuid": "0ca5fc17-38d7-4ebe-b190-9d28b7fb9750", "comment": "Malware payload (CobaltStrike)", "value": "0361269b932307ae4a1a3ecfb75288a4ff1d87ed", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310377, "uuid": "30e1dc5e-f5c6-459c-a4d6-a9eeb4cd47d8", "comment": "Malware payload (CobaltStrike)", "value": "9d27c1982269b196e6c666d465978a5ab54a9ad7e9bfa9db6eb71f85b61a8979c35aaa2c947bd2ca9e4266695ede2474", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310377, "uuid": "ac65364e-0961-48e0-91aa-c3c8fad736e4", "value": "T141256B0BF6B842E5C0B6C17E8593966AF7B2B851473083C752919B1E5F377E4AA3E301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310377, "uuid": "94469090-032b-48d0-949a-1d27ed87b824", "value": "a62a4e55e145a922e3a860d82c01e587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310377, "uuid": "06bb0f34-d050-49cb-ba1f-c544c5a5d512", "value": "24576:p1PghBzKWN1zjpjLJ1RxfawzZA2UDF/WYVO0dq:pVax1zBLnfNZA2UDgYE0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310377, "uuid": "08c89c7a-909f-4707-8fee-7e65ad961116", "value": 1004307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310377, "uuid": "44992736-29bd-4849-9eab-4d969b2edb30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310377, "uuid": "a485047e-f890-4125-a40c-15e66564ce84", "value": "f3b33d5bf9d6f3b2ccd0a670424fa7ac.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba0880f-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload (XorDDoS)", "timestamp": 1648268982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268982, "uuid": "9b5fba44-4131-4ea4-92b1-271ad479e7b3", "comment": "Malware payload (XorDDoS)", "value": "67e961108f30aca1c81e841310ed1181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268982, "uuid": "586853b5-f9f3-4add-b103-bb6346773bd3", "comment": "Malware payload (XorDDoS)", "value": "5e46e3a298fad9fc1d9e9bb45e7449a7e07e1f36af47e2ecb465929f45ba1b13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268982, "uuid": "84e9a00d-b45a-4804-953b-f75cd88faf2a", "comment": "Malware payload (XorDDoS)", "value": "47cfc971bc5955e09faafe12cd7cf08b3158f970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268982, "uuid": "ae1e0f67-e076-493a-8269-786ff2b29417", "comment": "Malware payload (XorDDoS)", "value": "b8833feb911fad45e592b4112c00eebb60a2bec397589c4d3e5deee16bad7cbc1aee888d34454a633929898e10e1ec03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268982, "uuid": "6b98372c-a036-460a-851b-72201b91fbec", "value": "T1204422FCEA46E5B3A93107BE704836E9019CE5DE41BE3625E35DE086D236183EC84E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268982, "uuid": "37ac259b-3f3f-4f73-beb7-7f0ff5319559", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCnSgmQ/mqYq:mZRgUY/fsJcO1KOiXe+Qeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648268982, "uuid": "5aca532a-74b7-44dc-ac6a-44208b8b9063", "value": 253408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648268982, "uuid": "e27896f7-8744-4e8e-8bf0-be5fd8c195e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268982, "uuid": "e228aa43-4921-4d74-8008-bcbf42ac8f13", "value": "a-xorddos.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d503266-acf4-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1648292473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648292473, "uuid": "3dc86117-cd41-413f-b68e-7d837be2995f", "comment": "Malware payload (njrat)", "value": "3db880f713f61cb4e2d8db8bd6a5d110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648292473, "uuid": "f23e7bf7-7e71-4c0b-ae94-1f8c9fd1361f", "comment": "Malware payload (njrat)", "value": "5f4be5b1118b3a61f72cf7a9647d5542fd52d470be2eec3470f53351a4c9f6ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648292473, "uuid": "cb2c97dc-7f2d-4876-9189-d2507e07b21d", "comment": "Malware payload (njrat)", "value": "d2325be5d84bd947e8fd4129e31fe75235fa5bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648292473, "uuid": "56bf0ffa-5245-47b5-ac41-9107b814fabb", "comment": "Malware payload (njrat)", "value": "5f350ba3a986d7f003c344ad628210872469691a76316d0b579d61fa8f55f0fd40fed37ddfef2d03c9d212f9ee50f1df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648292473, "uuid": "f3e53baf-84c6-4a5d-ac66-00059e623906", "value": "T167F4198D57F81A5BD03D57B09822699083F0EDB67A22C3AD3DC0F8CD6E717D486522A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648292473, "uuid": "f2655253-9e21-487e-9936-811dbcff5db4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648292473, "uuid": "25454be1-874b-4592-88d8-ace6bfccb874", "value": "12288:PSzHrOsFpjJFHaQ3TsskGSSO5p+WW0YFyZ7n:PEHrOMpjDHaQ34sLmbYFyZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648292473, "uuid": "9ae17665-6a98-4beb-9a5d-09e5e386a87e", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648292473, "uuid": "75eb7492-10d4-42ef-9599-22a40b786041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648292473, "uuid": "51e6d9bf-a8c6-47f7-9d74-2348b41a7134", "value": "PaymentDetailsSlip340999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8032e9ce-ad1d-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1648310275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310275, "uuid": "1c5f9445-70d2-42c2-ad7a-72dd82590992", "comment": "Malware payload (GCleaner)", "value": "45abb1bedf83daf1f2ebbac86e2fa151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310275, "uuid": "669f7ead-02ff-4559-8621-e6fd49194d01", "comment": "Malware payload (GCleaner)", "value": "611479c78035c912dd69e3cfdadbf74649bb1fce6241b7573cfb0c7a2fc2fb2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310275, "uuid": "28f45496-56b5-47bc-bd13-97fede49fa69", "comment": "Malware payload (GCleaner)", "value": "7d9ccba675478ab65707a28fd277a189450fc477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310275, "uuid": "8bcba655-c187-44aa-96ce-49362ba78d0d", "comment": "Malware payload (GCleaner)", "value": "2af6cb1d93d0f98c2a9c6462bb49772fc3f4b672ded9bf7c371910c85486ea0dcc4709a48b31c424f65d74b071d52513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310275, "uuid": "938188e3-040b-49ca-a0d8-d1a5afadefe4", "value": "T110846B34E201F026F4E20035EC5ED7FA65286B30275498EFF3D55EA9AAB16D1E230B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310275, "uuid": "457bc804-6525-46fc-a4e3-8f5a059ab5b0", "value": "9734ba8626408cec04bb8fa7d8bb6e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310275, "uuid": "e50d702a-ddb3-42d7-bf21-4cfcb3cab422", "value": "12288:3ZFjgB8S7dgKfFTJnUxzJQK2LM0r04JduPK1LOE/BE:33jgCS7BFnUbR60wLLOSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310275, "uuid": "77932500-ed93-4364-b237-89d0a0bbe61a", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310275, "uuid": "6cc1ed99-35d7-4365-aaf7-9b2ec9ba13c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310275, "uuid": "1668b1dc-bd50-41c1-819b-9abb0d38c399", "value": "45abb1bedf83daf1f2ebbac86e2fa151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721b247e-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1648269020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269020, "uuid": "d1466da0-70eb-4653-bcb8-d849b55ab848", "comment": "Malware payload (BazaLoader)", "value": "d29ab35c082de1aa24d5be4753f3cef9", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269020, "uuid": "cf942231-518f-43d6-a43f-cf0c0e2e0282", "comment": "Malware payload (BazaLoader)", "value": "613bdb31030f80182c8b62d356faacd91f74e1fe843f85a093a384938ff2cfc8", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269020, "uuid": "4d53bac7-7360-4add-acb2-5ac82aeb204e", "comment": "Malware payload (BazaLoader)", "value": "d806a964ac7ed11df30b8f075963098760fdfbac", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269020, "uuid": "0dcc7dc2-fb00-4a23-be82-4bb6323c55f3", "comment": "Malware payload (BazaLoader)", "value": "3e99e4ab4ea5539c4d67f68388df249664c6124f69aef940ed584f78fd1c7f1c659e298afc7f236e9927f653616c0a3f", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269020, "uuid": "3ccec14c-b545-4051-9f51-9d367e09e67e", "value": "T1F381D369074FCAFCE653F9C881D56A43EBB586274A2CE6C4CF60BEE6340456CD4F1858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269020, "uuid": "26f0348d-da83-4865-9c2a-6bbd1fe7a28e", "value": "96:i3vHEmsq8yNbk0VphKJHmobDpYoxzwzjXy6TQ0m2Fzyzz:gqqpk0VpsJbJx8nNMJ2Fzcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648269020, "uuid": "9af419b7-47ad-4148-8020-5b61c4817036", "value": 4038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648269020, "uuid": "69b91697-666e-455c-868c-824ab2b0b448", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269020, "uuid": "ceb56964-19fd-401a-840b-de44d05443aa", "value": "bF4rLSD6Qd.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5579a1b7-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648310633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310633, "uuid": "31c7b798-236c-4a9e-a3fd-eb5f5639df0e", "comment": "Malware payload", "value": "aeed3e2484e5f536dfc684a28fffbdd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310633, "uuid": "acb2ff21-0185-4696-9e17-9786e2bb4ab5", "comment": "Malware payload", "value": "61730db0ed76c59d8b26e429a5b4c98a19518c549c6dbf91ad5a0002073a13d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310633, "uuid": "6fcf798a-bee9-4353-9924-ba6359850158", "comment": "Malware payload", "value": "42a25b218e25d85c6c518c925dcb41c3d17db56f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310633, "uuid": "86409f75-b07d-4f3c-9084-917d086debc0", "comment": "Malware payload", "value": "a87ffd1c964081a9dbd8b9fc1142613e33521039a0f8b5a16b50e3ee97e668e545a2b69e1eac2914512a1c24842845be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310633, "uuid": "e090e670-d001-4e98-9625-dd597280a1ed", "value": "T1145633367A357810C4B866FDA90773D0C03A27DD63D1F99C3E8818DECAA32D5691E6C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310633, "uuid": "42f0540d-5272-4451-91b9-a4c53026f923", "value": "1d08943678f1a8b719433ebabbe525cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310633, "uuid": "386ac880-8d4c-490e-b0f2-8bc670c880cc", "value": "98304:5NnAMWh1JSsp0oC0kZL8AUewZ/baRwanCxoSERgUEdqxYseHhPzgVYkUUhgKiotG:5Nn0h+sp0v0k5bp62RwanCxjU5x+baJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310633, "uuid": "e695b4fe-400d-49c0-a1fc-affcb0adc116", "value": 6222049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310633, "uuid": "146ba1aa-b0ef-4ae2-8386-3d01ae0b8509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310633, "uuid": "7af6f1ba-30a8-4493-8b84-5d3190a9a862", "value": "aeed3e2484e5f536dfc684a28fffbdd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267691a4-ad4e-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1648331170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648331170, "uuid": "234b820f-6db8-4c87-bd7d-79f7053fea8a", "comment": "Malware payload (NanoCore)", "value": "c44fdbf93ce77d7f3edd78f4e56ddeb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648331170, "uuid": "f553e8f4-add6-47ec-82db-68613d728b40", "comment": "Malware payload (NanoCore)", "value": "639bc1470d85ef42ec4925cc4d57c0a69dd21b95418e0af074c9c5b40e74b896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648331170, "uuid": "7c04af14-fd44-415f-b403-5b6f85bccaf5", "comment": "Malware payload (NanoCore)", "value": "a1c2abfcec8cecc72799a3ae8b7fb88ef446a4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648331170, "uuid": "ddf34761-5b2a-4c88-8643-dfa842c10c43", "comment": "Malware payload (NanoCore)", "value": "2c2dff6440e358095ff56a9246800960ec3a739f4a3f2a53833f8f8a4d41def71440b5722a51fab0c2f7549ef06e203a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648331170, "uuid": "fab999ff-7cec-47b1-a482-7b7dd20e99dc", "value": "T1BA14CF563BE9492FE2DE867A602251139378C2E398D3F3EE18D454B35F267E50A071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648331170, "uuid": "617180e6-dc8c-4bf2-b9f2-9f252597fcc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648331170, "uuid": "62529ca3-88c9-4405-be0a-8160834123ae", "value": "3072:izEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HILDuGTziui+IOIB3089u1L5WUF:iLV6Bta6dtJmakIM58NilOIW8uxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648331170, "uuid": "d7710ece-1537-46af-87b8-f59c11e48ef4", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648331170, "uuid": "509f7a1d-2fda-42b9-a33d-35ae98c81c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648331170, "uuid": "575c315d-1dea-48b1-9ec6-09e05ffa1d06", "value": "639BC1470D85EF42EC4925CC4D57C0A69DD21B95418E0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fb20a8-acb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648266537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648266537, "uuid": "ababdbb5-6107-4e45-94b9-b37ca70b2280", "comment": "Malware payload (Heodo)", "value": "d5b33680c2c58e0cfe160ae0c22d616d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648266537, "uuid": "614e1399-b034-4c66-9907-222eff44c2b3", "comment": "Malware payload (Heodo)", "value": "64f1d34a5d9953e321a81aa8627c27a8c673ca2a2c9ffacabcb0bdd317502fa2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648266537, "uuid": "e0fadf45-b5fb-4a24-9829-7ee7a17568c9", "comment": "Malware payload (Heodo)", "value": "9b9020c88fb649d5789eb7b5470fff4f766e4938", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648266537, "uuid": "f9761165-ce3e-40c4-a401-5e5b94413916", "comment": "Malware payload (Heodo)", "value": "3eeaafa4a1334bbcb6b34ad99201d803e469ab8d275f291a435149d270894900f1be77645da2fa0f371f12f3443604fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648266537, "uuid": "ca380fed-0e2e-4c16-97c7-744177701ee7", "value": "T104E4C53D2FAE4062D8660770145C0FE991ABCE25BB2255FF65842E2E2EB57C74879F0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648266537, "uuid": "b1ce446b-79cd-47e8-9382-ea129c497336", "value": "70b8cfa68ef2c7898ee65b9a0ce218ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648266537, "uuid": "ec83572a-08d9-49b8-bc1e-82e65e709c2f", "value": "6144:iKfJCALkjp1g4SbsLyKilbNUBmB5XORDlsOMAidDNcYs6kzpYmcHWk870zCb:iKJCPjp1g4SbBKilbUD4LmQjcQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648266537, "uuid": "a167ff25-b45f-4b16-b6dd-69646d691b72", "value": 703918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648266537, "uuid": "b8a0210f-1c0d-4002-a8e5-cb8db2b70a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648266537, "uuid": "df5c0f56-64ad-4a52-b0bc-094aa69051b6", "value": "emotet_exe_e5_64f1d34a5d9953e321a81aa8627c27a8c673ca2a2c9ffacabcb0bdd317502fa2_2022-03-26__034852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2af45f5-accf-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1648276859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276859, "uuid": "73bf2213-5eb6-444b-b75f-00ef26550d4a", "comment": "Malware payload (Socelars)", "value": "db0db8f8f2a2ea6c9e4f59116602cd3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276859, "uuid": "544a4337-d727-44fa-a8de-53020816f5cc", "comment": "Malware payload (Socelars)", "value": "65bd7e49fe292748f0c504dcbefdb0ad86e69c8349d7253d0e95ebf1bf0110b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276859, "uuid": "d3c588a9-0f58-4cb7-b897-51a0e57e601f", "comment": "Malware payload (Socelars)", "value": "c5614e93a234c31c3c28a3eb8752f93b6babb60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276859, "uuid": "3781abbc-fa7d-488b-9d37-be91e2d41b02", "comment": "Malware payload (Socelars)", "value": "682371f3134f18eaf0b8efcfe5ef75a9f0f3c8b54d8270f81ef497e8e7d655196da39dc6d8280684ec8d3201e4dbe940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276859, "uuid": "9453da19-5985-4cd5-85a7-930b789f9210", "value": "T1C1858F03E24261B6D8E6417385BE46BE4C246D35235C60DFB3847E6AA5714F33B36E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276859, "uuid": "14bd3d42-4480-4050-b743-905d23058640", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276859, "uuid": "12ac537f-6a69-454b-bbce-93d7eea80cda", "value": "24576:wKAgpBGV2HpWHuREjDnI2AuADZ8KvqC75H2dtDPc/ExKFY/fwg:OgpG57R8InDPcsxKC/fwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276859, "uuid": "55938738-6e2a-4710-8407-6111ac167c3e", "value": 1786368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276859, "uuid": "d552568b-bcce-4b89-9f88-f561d0ec20ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276859, "uuid": "71dcaeb5-028a-46fe-8cf6-30f194e0b936", "value": "db0db8f8f2a2ea6c9e4f59116602cd3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcf29b7-acf8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1648294410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294410, "uuid": "0efc06d7-783d-4ae1-9490-d3c2a845128e", "comment": "Malware payload (Formbook)", "value": "3fa5f0ae62033d1eeb6a116761fc74dc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294410, "uuid": "2b17a67d-ba55-4c18-b58c-6716219cccee", "comment": "Malware payload (Formbook)", "value": "6782027a577e4251b8f3dfed109ac23b92edcf0420edd39cc22f1a9e9e41c3bc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294410, "uuid": "de321895-c3d6-4d09-8014-904ed2570c08", "comment": "Malware payload (Formbook)", "value": "9471f165f363d17f06345a3c28ce2bf9ee1cd06e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294410, "uuid": "5c098eb4-f1ce-4043-ac9c-1aa890a64c8a", "comment": "Malware payload (Formbook)", "value": "4e5d81ea38c3a4897f6ec9ad990e20bd29c74761266216830fded73e6a1a76eeccd5a248749ff3bf4f0629442a2a7748", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294410, "uuid": "a262fdac-88d8-4080-8a28-38b965325602", "value": "T13F1533CA7B6D70A8E294BDD85B4E3578F440861CA2121DE04BD08D8FF66BD34AD61F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294410, "uuid": "f0c0ed84-e39f-407a-987b-e5341f55b7ee", "value": "24576:uFdhuw/uLR1pFzNj/znX6KlTomKgyBQP5:qhujVPFzN/zblToXgyB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648294410, "uuid": "fd42a350-2571-4ba0-ab9a-a34166bd07ca", "value": 955262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648294410, "uuid": "2b38dbb9-7bae-4964-aafb-c57014ee29b1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294410, "uuid": "a4c02d0f-7e2b-4e5b-923d-04753e9c9633", "value": "Bestellung.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0615b3-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1648277331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277331, "uuid": "ed01fb04-dd08-4c83-822f-680a51c6e05a", "comment": "Malware payload (Loki)", "value": "0e4d5b5a90e7a602d2e5447f854b83c7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277331, "uuid": "b5763f7a-9805-443f-963c-b6d15c44f4a2", "comment": "Malware payload (Loki)", "value": "6a7b8c020f13fe58203fd2f53727b5502353dff502f3e47ded1f50dd02f1c3f0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277331, "uuid": "eaf0f50a-f4ab-434d-92cf-14636dd20e50", "comment": "Malware payload (Loki)", "value": "6719d45c1ddca09e62beb81df9b96aef4423e231", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277331, "uuid": "3300c1b4-9aea-4143-8bb3-ecddd0c7323e", "comment": "Malware payload (Loki)", "value": "52144be91ae441c1f749a90a0fefc005d19d07aa2ef7ecf81ee4885ed887e814ea88509255af3b6c6a63c35efa5e5e4f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277331, "uuid": "9c715b53-561b-4e87-86b2-67225fcb6db5", "value": "T1571412682376827BFC4F2A35219D43E89F96BD1A0570584C2E23F1372B791558EB3DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277331, "uuid": "6fb126df-3539-4739-9852-f736091ce409", "value": "3072:Pz6nPN21nYWJNhu1RhndFbg+62bN2UyWn/hM9gLiMRtfo6S4S6j6ld:GnPN21lJNg1fdFbg5252EZMSuyS6Od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277331, "uuid": "78b7019c-d275-4682-a72e-ff9455476cb4", "value": 192040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277331, "uuid": "a906cfa0-0fa0-48c9-b3d5-1b41c88d1e7e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277331, "uuid": "e2b2a9e9-63b3-48cb-af14-1784af45e74b", "value": "\u041b\u0438\u0441\u0442\u0430 \u0437\u0430 \u043f\u0430\u043a\u043e\u0432\u0430\u045a\u0435 25-03-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f098c9d-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload (LoaderBot)", "timestamp": 1648310649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310649, "uuid": "84aaebb9-dfb7-4bdb-8619-58c9f292dac0", "comment": "Malware payload (LoaderBot)", "value": "ab0637f04f820ffb2ec87cc2e6ac9090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310649, "uuid": "4544e35b-c55c-4ca5-b36f-1a8af818d2ec", "comment": "Malware payload (LoaderBot)", "value": "73af06471b22e157f28e047b508015b9dffb41ae1972ab698f8d949976e7b139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310649, "uuid": "ad4a40da-c9f4-480c-91aa-2cacc85b9a3b", "comment": "Malware payload (LoaderBot)", "value": "b4e1955e7e42965d419a542edfb62defbb47d7d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310649, "uuid": "d8e531bc-54a9-440d-a3c0-3f94a52de7c7", "comment": "Malware payload (LoaderBot)", "value": "1bbdf3d8b4a08a2bdea9129fa7dc03e5de47de89fd37de84b1b7a7a9d3810aad93a66b25dee500f9a6b658d85d291b7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310649, "uuid": "6356a13d-3250-4b57-afad-f329b84679ae", "value": "T1DBF5BE02BFD54F27C596473C8AE7836873B9DD800B43575BA24AB1293DB23E46B871D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310649, "uuid": "3f7157ca-d4b9-493a-a95c-c6c188e4a3ae", "value": "24576:kHnNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcer+5kwj:kHNDFFPJu8fBsVE6ij+RNg+UKpBv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310649, "uuid": "5c153dba-4283-42a4-9137-319650de3050", "value": 3470977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310649, "uuid": "221a9abc-d813-4be1-b685-1031556db042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310649, "uuid": "e2c9e991-ed30-4009-abbb-76a52f872c92", "value": "ab0637f04f820ffb2ec87cc2e6ac9090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770057ce-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648310689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310689, "uuid": "3c5725f4-ee3d-4292-a108-639c4e2bd285", "comment": "Malware payload", "value": "81959136ef420f9a794d5d56e743105e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310689, "uuid": "73c79e51-58ac-4f5f-8356-d06910fdfb35", "comment": "Malware payload", "value": "744a05e76f8d36f3a5be446e024f185ce5efd90dc094d749c0aa8685b3b16860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310689, "uuid": "40872cd5-f726-471e-9f96-9efadb5af395", "comment": "Malware payload", "value": "1d411815b32482e05eeb883c7d4853829fa55af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310689, "uuid": "6c1ab680-3bca-4ebe-8f6d-a71609ad72bd", "comment": "Malware payload", "value": "d1366a45a18c4ccd616cf678f61bbf7ca2495b08ed3e3e63f6ca44792e463cb4032f42c7e8953983c26491d10c4c51f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310689, "uuid": "3a2d743d-b30e-4bab-b269-02d655eb5b97", "value": "T1ADC5336D4AFB79A9C9C7A0309597E533E1543E98F9CC2D872EE63F37B8A5905E0C4840", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310689, "uuid": "c54f67fc-ee7f-44cf-afa0-47e3cf867050", "value": "01d1b984e99e67b6f7ae46199d7dfd92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310689, "uuid": "2c71db04-b829-4faa-96c8-986bbd0fcb6e", "value": "49152:K9SRQo3DNrOKFcHxALBpIHo9HYdZvXYEj4UDEbVhqTig2Iug/xRNG:KMRQo3DNry23M80F4WyhqTi5Iug/xRNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310689, "uuid": "831f3463-8398-4bef-b8cf-1dc7cc865aeb", "value": 2651384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310689, "uuid": "a2ddb86c-0391-4514-ac46-f9effe17f4f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310689, "uuid": "7f8471cc-19f6-48b1-997b-ff85bd23493a", "value": "81959136ef420f9a794d5d56e743105e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a3628f-acdc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648282557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648282557, "uuid": "86f54901-ebc0-4637-b438-75aba9113418", "comment": "Malware payload (RedLineStealer)", "value": "b7d0e437671265571a79d39b90e8ea65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648282557, "uuid": "a509b319-4d7b-42d1-afe6-6770d7e454ad", "comment": "Malware payload (RedLineStealer)", "value": "756e3399f2905aa3358e4045185fad0c6902a91d3995cccc0198f3b056323f34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648282557, "uuid": "3061603b-3376-4094-b634-7bcaa75f913e", "comment": "Malware payload (RedLineStealer)", "value": "fd10e8319aa4f3b8a5adee1365edbd99838a2d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648282557, "uuid": "9e358805-04ee-4b02-a9c0-5af073eeef86", "comment": "Malware payload (RedLineStealer)", "value": "6e1203a57ef5827c64bc68afbe1cb54bcf23c6238ae6c19e465e7b2bd49be8defafc2ae04f2d3fb4494786876b105a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648282557, "uuid": "a2948db1-9eef-4b9c-8e7d-062f1a143619", "value": "T1EB24C02E3A818432C453003579AAC6A26A3FBD320776C8473B86577E5F713D249FE75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648282557, "uuid": "9f1f7e60-49c9-48c5-8cad-cd740583dcf1", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648282557, "uuid": "4c1a7b4d-afad-4b36-8c35-fcaa61e052f7", "value": "1536:zgKtN3iACq1ntP4qlUL8WWeTcBrz+fw9/0OYmXqVi5h/emzM:zgKtZZ2GUL8tBrz+f40gXq05hrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648282557, "uuid": "bf4a0a24-d95a-468b-88f1-abf45004c1e6", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648282557, "uuid": "a0d5e5cd-426d-45e1-9d8b-92635ba2c19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648282557, "uuid": "958ac091-3eae-43cd-84c7-34995a9c392b", "value": "b7d0e437671265571a79d39b90e8ea65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd441b2-aceb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648288854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648288854, "uuid": "40e92434-e0e9-476d-9859-f2af05fb982b", "comment": "Malware payload (RedLineStealer)", "value": "03d3706f3b6c6f6df252ec64c2488edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648288854, "uuid": "c12d7462-f1e2-4351-a4d3-4fa2cde69a22", "comment": "Malware payload (RedLineStealer)", "value": "75e500ff21943d18fbbbccb4101f085ab7eca1e8987a859140ec791382a2cb08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648288854, "uuid": "a5b91011-a504-474c-93bd-7ff88502a3b9", "comment": "Malware payload (RedLineStealer)", "value": "ca8f6fc5274907758d161e843c8caedd0d48bfdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648288854, "uuid": "cbac9683-7c66-4f63-b337-7761a2f00cb0", "comment": "Malware payload (RedLineStealer)", "value": "52ccc2f1a0421167ade52f9e6254bdf94e776af277d66ccc2420341e8b70131bc52d3c46cdb77d36f323f3c00c36f03d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648288854, "uuid": "5f7f8b62-990e-4881-a861-3d4fa09c7a47", "value": "T1B1645A2439EA901AF1B3EFB69BE475E6DAAFB7333702945A1051034B4B13A81DEC153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648288854, "uuid": "ca78e555-9bfe-41d1-9ca4-19f167f67146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648288854, "uuid": "c94a19f8-c927-4eb8-a28e-706809255a7f", "value": "6144:eRclmN+/cgbILIKCk/jsMgRF0EEiMEubY23HcaX7QMfXqs1GO1vKHS08T:TAIKxbsMeF0EXMEub33HcarQMf6+9QRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648288854, "uuid": "53076337-4166-4dc9-bca1-d51ae807b91e", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648288854, "uuid": "dea6d3d1-ccae-4c0a-a527-f7fa7af5eb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648288854, "uuid": "f218ec41-15c2-4fb8-bfa2-5d373c928027", "value": "75e500ff21943d18fbbbccb4101f085ab7eca1e8987a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee528171-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload (Worm.Shodi)", "timestamp": 1648269228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269228, "uuid": "1905a259-49af-4cd6-9e69-95c766196aff", "comment": "Malware payload (Worm.Shodi)", "value": "16236fd7a97c33567427db7a2576ad04", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269228, "uuid": "3d2b1c40-c7e2-49a5-a5e5-6389e23c8f89", "comment": "Malware payload (Worm.Shodi)", "value": "79338eecf47b2683d5480886e9ae229d378899a8252704e9fc71f5a356d3c81c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269228, "uuid": "eb5e4f57-be0f-46f1-9486-51ba635b7f8d", "comment": "Malware payload (Worm.Shodi)", "value": "31696fb55af4014d21e62dafb766dc509e141873", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269228, "uuid": "3ac30586-610e-4811-b77f-cbaf4268ef09", "comment": "Malware payload (Worm.Shodi)", "value": "97cbc4b40dc78af91af30adc9975076ed377662dfbbbc7e7812b9b34e9e2e655287f7f9050801f739698697d11cab305", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269228, "uuid": "8870a63b-cec1-4b34-8c85-21d3c614980b", "value": "T1A3A58D02F6D082FDDD724130C9A966B5E5BA7C305A30F64B339C6B2D1E31D90AA37B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269228, "uuid": "06c93209-d043-4b75-a939-73cedf5c870d", "value": "49152:D39U0K39UNK39UNK39UdK39UdXpiMp35DMnCIjtAy:bpix55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648269228, "uuid": "cae9ea11-eeda-42c8-a8e4-f4c788541592", "value": 2223896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648269228, "uuid": "e42503f1-149d-442c-b4a7-e7def4a24477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269228, "uuid": "d0082eca-d70a-4fa6-aad3-56c572d9bcb5", "value": "places.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e51c47a-accf-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackShades)", "timestamp": 1648276584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276584, "uuid": "66b39317-9a1d-4b3b-a838-d1ef2ade681b", "comment": "Malware payload (BlackShades)", "value": "60ff3ad315e402f2a8aef07c16969db8", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276584, "uuid": "a9071523-7c8f-40b6-a871-96a737f2f356", "comment": "Malware payload (BlackShades)", "value": "7c9f93b958aecbd7579076017bd926d843465b3e15240c01952152eb6d4b3b7a", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276584, "uuid": "810e0645-2336-4323-915d-43c80f737fb5", "comment": "Malware payload (BlackShades)", "value": "e29ed4d879d312d0be2b3ce73781cfedcefddda2", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276584, "uuid": "1238ce36-d9c7-4950-95c8-837e69fcbea8", "comment": "Malware payload (BlackShades)", "value": "60f6930d05fb53ca1ad2e7479eefbd4398fa0959a6bcc9f457a3bfdf7d408d9336cec8f74f66343402a5d853dd279234", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276584, "uuid": "d8a4af9f-bab0-4cbf-8d69-0e0fa3ded5de", "value": "T101742359B28D2DF9F9F21DB4E4AD70721795B9125257333B6C99C0883B32464CBCAB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276584, "uuid": "d0c14460-bffd-4916-acba-d3bf4c41e093", "value": "f914de12ac2ad329ea629d805d4b3a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276584, "uuid": "cca9cd47-b24d-4b6b-b94c-344d11d98894", "value": "6144:zLEchZLsu1AcKKIFrMg3p/UHLEhtfwjH5fc1zdLThGniSRxixV4naNiEGoZSKaUd:0iZLn1SKIFlUHLEk75UJdcniSRxuV4aF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276584, "uuid": "f5554335-d75e-413e-aceb-829660c8813f", "value": 347384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276584, "uuid": "d99fbd90-cfe8-4fdd-92f2-8c685eb0ae7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276584, "uuid": "dccc0365-2b76-465d-974e-6c6d1c5c038c", "value": "WinSystem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478da22f-ad11-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648305026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305026, "uuid": "cd0ec60f-2c9b-448b-810a-a5201faeeb74", "comment": "Malware payload (Heodo)", "value": "a97d3b80dfd9257e0f60085b1cfbfa29", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305026, "uuid": "da603683-fd8f-4f34-bf17-5eb19d6fbcb7", "comment": "Malware payload (Heodo)", "value": "7cd11785bb53cbca4f762cde46583cc3cfb168448e766b555a7a0c396bdbe78c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305026, "uuid": "78c7ce33-850e-428a-b7f4-6171f8582b20", "comment": "Malware payload (Heodo)", "value": "5a070a344f0e7518e7ca98f4d5a38c2f56099f29", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305026, "uuid": "289f5103-5a1f-4f34-9c01-802dcbe94b65", "comment": "Malware payload (Heodo)", "value": "f80b6c2b2d621bc17e88f1122b29c4e836564c9dd0fb24c4e021beb274c7dd6988887619eb27a871fc492116442fd351", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305026, "uuid": "f9e72804-3f70-4161-8986-2dea01b2f801", "value": "T1FD448D40F2D984BAE2B72B34257247225A76F9127F3CC28FB35489899E31780DE3575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305026, "uuid": "90c06c57-3b1d-4426-bdb5-61ee7d6cef1b", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305026, "uuid": "15ba50dc-8aa6-407d-8415-30401361b739", "value": "3072:XHXgfYaYs8+KdMDxl0hn61lri+t0peNEhhqZnn+E5n7I8tnOLt5ZZnAq+:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648305026, "uuid": "5ec9590b-f88f-4c24-8986-5c203e3943bd", "value": 258200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648305026, "uuid": "e3b930d6-fda5-4468-98f6-ffaddff3ef3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305026, "uuid": "8cfe30b0-c224-4a2f-b26b-b372bea139b8", "value": "emotet_exe_e4_7cd11785bb53cbca4f762cde46583cc3cfb168448e766b555a7a0c396bdbe78c_2022-03-26__143021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b9d124-acc4-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1648272093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272093, "uuid": "64cad089-d02d-48d5-abb8-f9926657abef", "comment": "Malware payload (CoinMiner)", "value": "e67ccebbcd6b59b896d8eb5cec8e0823", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272093, "uuid": "483c23a4-7d3a-4603-ae6e-8b8938272629", "comment": "Malware payload (CoinMiner)", "value": "7ee182a4e061b93eaa096b87b0914d115f5c49d2812a6c81c62a836892adc359", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272093, "uuid": "78b211b6-b613-41e0-8481-26dc7f2849f1", "comment": "Malware payload (CoinMiner)", "value": "266ce8c33df48bc31cb3a29da5ccee3670da7c8e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272093, "uuid": "39a25b1a-553b-4207-a249-d098cd5037d6", "comment": "Malware payload (CoinMiner)", "value": "4616332abebb6fbc0a7a5cad34d1b71d630382dbed59db317bcd526e3527db592dad96b7f85bb0bce6ffc9c9a96df110", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272093, "uuid": "dbd78656-b4bd-4526-9ecd-7c0ad7a52373", "value": "T13B0456DD726072DFC867D472DEA82CA8EA6074BB931F4213902715ADEA4D897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272093, "uuid": "c54fa426-e687-438b-b210-075932a41c21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272093, "uuid": "8f4e454e-4e10-461d-a603-6894f4d14692", "value": "3072:JsXucoiBDrm6EagaYx1NMjXFc87ty2NV2wEY/vVhMrkxF6L4R:quI1y6+a3j287ty2NV2wEY/vVhMrkxFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648272093, "uuid": "85e61fbc-2f32-4eff-86df-c4551957c844", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648272093, "uuid": "71b67da3-090f-437c-b2d3-2c0165ef3fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272093, "uuid": "c754dc43-7522-4a0d-b0ef-cfbaf3eb0de1", "value": "ginzo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f58f6cd-ac9f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648255969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255969, "uuid": "3760b84e-d644-4839-a04b-7a94e20ca805", "comment": "Malware payload (Heodo)", "value": "48739cd03f22fb3d587726021819fad9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255969, "uuid": "c17bbf76-4a8f-47e5-b299-78abae169f33", "comment": "Malware payload (Heodo)", "value": "80e3617d6fa68901424d2699a21b2d2efc8a4f61ffd120aa50a0bfcb119a47b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255969, "uuid": "ae98807d-db30-4f0f-9627-2b4bfc8e64d8", "comment": "Malware payload (Heodo)", "value": "a315ee4c4d71e17d2fbe4cb30911ed8d923d08de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255969, "uuid": "eafef2d1-b61f-491b-a06a-236469fa2f22", "comment": "Malware payload (Heodo)", "value": "626b161130ef8c4b62991b74aa8c2a6c14ca0ad0a85de94d986669eca4f7c64525fc57f30c36cdea0628550aa444566c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255969, "uuid": "c554c14a-b4d2-4de4-b5ed-31fb2e7bd147", "value": "T191B45B0173C390F0C657A574840FD525ACB7B83C6B19857EA28BA26F4BF78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255969, "uuid": "7e0e0c8e-9faf-433d-8b3b-c2bf57b563a1", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255969, "uuid": "41f01563-f967-4474-a115-7db34a0ce7f2", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhA7ArkqBoEimFmzUM090/DHr8cQE:S54yM33d3q3Z7BogxreNmF+U/9JckIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648255969, "uuid": "a6965824-85f0-4c60-a542-e86aab134fda", "value": 496112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648255969, "uuid": "c7f3c35a-a0b4-47a6-8eb7-69ea6ce2063a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255969, "uuid": "85039578-eabf-414e-9a68-cb92e8790494", "value": "emotet_exe_e5_80e3617d6fa68901424d2699a21b2d2efc8a4f61ffd120aa50a0bfcb119a47b4_2022-03-26__005245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d324041-acf1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648291319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648291319, "uuid": "04d5f323-facd-44f3-9975-4565cae908e5", "comment": "Malware payload (Heodo)", "value": "37f36367439aa134bd8cbbe051e2610b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648291319, "uuid": "71a3931a-a584-42ab-a663-c2f8e41319a8", "comment": "Malware payload (Heodo)", "value": "82a934192bfb517e035a593d03f659b3324ffa5b903ca59a2a0c1d3d3f6f47a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648291319, "uuid": "a858fc25-c529-4f40-9a3a-6f2c5763e9b6", "comment": "Malware payload (Heodo)", "value": "7bf65d4b1440bfbe0458bffbf3c1021038ced9b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648291319, "uuid": "dbfe9817-1379-4fd1-94dc-f131a8f9bdf6", "comment": "Malware payload (Heodo)", "value": "9b296bb3645c3860fd650e7b0173138e6c3fb7045dd8a8dc6edbca0bb887f9886a06987d13619143b86bac80828043e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648291319, "uuid": "ee264a56-cdd6-48e9-b5bb-5d0777352b42", "value": "T153D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648291319, "uuid": "d2903398-45be-4ebf-b07d-d594c4290856", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648291319, "uuid": "7034c45f-ec3e-4d6d-a56d-9d6dbbda207b", "value": "12288:UWBpwupxl0OeL/grxEGzO+r9AjCb/XKh:Psupxa/gD2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648291319, "uuid": "3c6cc97d-2ae1-4289-b1a6-81e6f2de62ad", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648291319, "uuid": "3394ade1-f2ad-457f-afc4-91f8911457da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648291319, "uuid": "fe4486f3-189f-4f22-bef5-9da88ed06b18", "value": "emotet_exe_e4_82a934192bfb517e035a593d03f659b3324ffa5b903ca59a2a0c1d3d3f6f47a2_2022-03-26__104154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2554a305-ad1f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648310982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310982, "uuid": "5d843010-d636-431c-b7e7-09593a63c55e", "comment": "Malware payload", "value": "538e0a0cd4f965e61921833b56594c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310982, "uuid": "6790fd79-c121-4278-8f39-4d428e1a6d8f", "comment": "Malware payload", "value": "857bcbe1462e6c137acb7a8dccd41a58e001fb7ecfde77bb7aa13cf83570c2bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310982, "uuid": "2cbb4fe9-27bc-4ade-b15b-83a984fafcd3", "comment": "Malware payload", "value": "e59a92cdea67a3647566a9828737f46ac85e605f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310982, "uuid": "3bdcc748-d44f-4f34-bd72-3564ef3f442d", "comment": "Malware payload", "value": "2ed21f8ce4478f8c0f6ba85037b8d611b97c16542ce966a7daa38022da18b4d2638e93c8e995b78533372d927b0bd3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310982, "uuid": "b67600fd-1de3-487e-8d85-6771e637afb0", "value": "T1BED53312B0399E60C4DEBFFE6D0601E4E3661DAEB6A2E9D93B102CDF8377105941D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310982, "uuid": "3608957f-52fb-4b53-972c-fb4c685b560e", "value": "3bb8a6893e884c662aa888ad252a201d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310982, "uuid": "35910c52-2a58-4d3e-8794-cdafaac78367", "value": "49152:eBvzkNnPS3MW/yYWqJSsJrUZFoC0OKYXpLP3kcpVj4HfUUewZ/LXUv4mUN0lOIad:5NnAMWh1JSsp0oC0kZL8AUewZ/baRway", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310982, "uuid": "7a8b292e-6558-4afa-a50f-001d1ce99645", "value": 2920377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310982, "uuid": "99d92746-e3e5-4192-8d97-199742d489ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310982, "uuid": "7b1eabf9-1d47-4e2d-b9be-66d135f6d38d", "value": "538e0a0cd4f965e61921833b56594c44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542c3a8f-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648277130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277130, "uuid": "eb484ac8-4e34-497e-9264-d1bd4311743e", "comment": "Malware payload (SnakeKeylogger)", "value": "b7c54a29c8a3d44b1a0e05427c6828b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277130, "uuid": "b99c8069-f85a-48f3-b2ba-a79e7ce1af2e", "comment": "Malware payload (SnakeKeylogger)", "value": "88375793210af06626d3ba0b0e9ea1fcf3e96142b182dc6e52095cdf5d37e6ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277130, "uuid": "a2d58535-f3dc-4cd9-94ed-24d44fb14b63", "comment": "Malware payload (SnakeKeylogger)", "value": "92868fbb6acfdd74438b317974ca04b37bbcb479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277130, "uuid": "ed0db537-bc1c-4389-8de2-0a1c2f38072b", "comment": "Malware payload (SnakeKeylogger)", "value": "1d0cf3f24a5add2a47c40b57444e162d329c439aced7da2356021d283e8e47594a3f82561c23b0426fc5b95a8e8d19cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277130, "uuid": "a44e8256-dc5c-49c9-b9f0-d01592021a6e", "value": "T1372512522DC0EE12D5B20F310C75A088DB35E2677258AAA4B8DD31379F36BA05B77BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277130, "uuid": "2a7b7975-63ab-4fcf-a127-566cc958055c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277130, "uuid": "d8e05f6b-ccc2-4398-b176-f13d579b3ce3", "value": "24576:Nz4p/QwRTLlm71N+GwzBalZrsLg7GkLOj:N0p/QmiN+j10YTkLOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277130, "uuid": "e8f71c9c-59cb-40e0-b5c1-8b44cfba3587", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277130, "uuid": "39c4c10c-48d1-45a3-874f-7e650421e504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277130, "uuid": "1a68fb2d-bbb1-43b3-8e15-8a69541647e5", "value": "43okwonRG8VRXUG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c71bc6-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1648269029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269029, "uuid": "23666382-e531-4393-9c0d-bc7508c02f32", "comment": "Malware payload (BazaLoader)", "value": "ba6d83d7d870f5a13b0c6bb93640468e", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269029, "uuid": "3727a7a1-8ed4-4335-8f0e-a7106e9d4bb5", "comment": "Malware payload (BazaLoader)", "value": "8aa0e44c0dce3a09f0acfbb5721f0acd632e8c23e97879fdf85d8ad53e617156", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269029, "uuid": "98fa1d51-c870-43b0-a819-995017d15cc2", "comment": "Malware payload (BazaLoader)", "value": "3d4a715dd00561eca1f8a9f0aad57b0298761bf9", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269029, "uuid": "9900f463-9300-44d5-9ff9-3f2e3ff78e30", "comment": "Malware payload (BazaLoader)", "value": "82cf89f393b9e16dc4bea24da007243c4bf179841f000f9d29e46595e2372d43f6c4b770b55d057dabad53e234cda44f", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269029, "uuid": "8c846dcd-01a7-496f-89f6-82bef4d3004e", "value": "T18D81E369074FCAFCE653F98881D56A83EBB586270A2CE6C4CF60BEE6340456CD4F1858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269029, "uuid": "8021cba9-debb-42b7-a676-b19ef6ba2ecf", "value": "96:X3vHEmsq8yNbk0VphKJHmobDpYoxzwzjXy6TQ0m2FzyzD:fqqpk0VpsJbJx8nNMJ2FzcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648269029, "uuid": "2c2afc74-1e24-4475-aed1-318430e6e9bf", "value": 3971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648269029, "uuid": "579c16e8-4fdd-4293-8063-ba63c5d971ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269029, "uuid": "715fe766-898f-4115-affb-e10fc90f8d7e", "value": "EXTRACTED_bF4rLSD6Qd.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e738b85e-ad29-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648315602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315602, "uuid": "3dd2e427-1227-45c0-9989-58ffc7479673", "comment": "Malware payload", "value": "ef820de9d4cbf5512960f5dc8ea8e723", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315602, "uuid": "5ea71081-ae3a-497c-be8e-fba6e92b80be", "comment": "Malware payload", "value": "8aa2abea2a4b0d23c8b69123860c1b35da3410bef737b50f54f59b3b9f745a07", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315602, "uuid": "dc46b499-668b-4ac8-9d38-12d8dd45be4d", "comment": "Malware payload", "value": "4a006cc23fb73e6a80ff5eb55cdca6cc2777ea6a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315602, "uuid": "21543217-602f-4165-bad4-66dcc66f56ac", "comment": "Malware payload", "value": "e25716172c6cff39bd1462891e68587b5d7cbc7243fb688360e6515c092ddb0cf1623e6c982db4d8aa3c503ef888972f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315602, "uuid": "389c3c57-b4c4-406d-8e07-f4fad236610d", "value": "T1B2C63302E3AD5C9ECCB48CBB19B70613A26F1E188191F71F0A68365C297BB551F15FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315602, "uuid": "2045ce4a-4fb9-43a9-86ed-d2c5707dd7c0", "value": "196608:jMEqvvZIEgCAD+trxZrKaj5G1TptMXq+a3MyAoFyaZ1QmXSAQwVSwRUuQp0:jMHhtr/ral6XVt8yaBXS5wA+hQp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648315602, "uuid": "47609eb3-6981-4fbd-9bb3-509dea5d6780", "value": 12257059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648315602, "uuid": "ceda7bfc-2eb1-4954-9197-729f9bd89766", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315602, "uuid": "5657550d-19bc-461c-9c56-146f24aaa28c", "value": "Health Report Record.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbe0fb3-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648269011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269011, "uuid": "212c7e49-732c-4fe8-b796-376dada0f214", "comment": "Malware payload (Heodo)", "value": "a6d1883f7627fd7dd3daad2aec7a9965", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269011, "uuid": "09d0f1b5-c50c-4d26-84af-cb60fe84ac47", "comment": "Malware payload (Heodo)", "value": "8ab3aa3ff28cc09f442dc1f1875ccd37f1acc6a764c669a9f43f1edcdb0052e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269011, "uuid": "2bf4f59c-8746-4fa5-adea-ec4977be7730", "comment": "Malware payload (Heodo)", "value": "ae7e1e87c3d6a2f098d7317f8a29615d3418cb70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269011, "uuid": "0dcc20c3-9c77-4e98-8d8b-ff19dbf20e93", "comment": "Malware payload (Heodo)", "value": "bce43feca447b1d7a3edd8606c0a9f8bc545dcace0eb4d1552f9f7b135d7ebb859b49361d560596a8564e3f34344135d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269011, "uuid": "fc98ee24-6b2b-40ab-97ea-57da119c4623", "value": "T1B6255B116385E03FC15F00F8178E6374B59A147D4BFACEDF526EADDD8A2C9E2A832581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269011, "uuid": "a21a5c0d-645b-4fa6-ab44-78129979c843", "value": "fba6073121233dddcde515a679fb52c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269011, "uuid": "81a6eac4-7677-4118-90e9-ff1132f986ef", "value": "12288:afBvrKKKK8/rIU1bE4u08v6hyIljiCcsQ77vWytGy56:afBvrKKKK8/rIU1bET3siZsyb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648269011, "uuid": "4b96f8dc-00a6-45eb-84bf-2c99262c3918", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648269011, "uuid": "ad3c2e76-78ca-4772-bba6-a3ccf2904e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269011, "uuid": "22c2b328-836e-44a7-b35e-29162097225d", "value": "axes.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d49019b-ad20-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648311613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311613, "uuid": "16635ff2-3090-49ea-ac61-b2ac1bf0f311", "comment": "Malware payload (Heodo)", "value": "c1d3f8ea4e99aafbab55af696fddbd9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311613, "uuid": "c1843729-3645-469d-918d-6ed37c8e8729", "comment": "Malware payload (Heodo)", "value": "8ae44676b3f76205726e336145dd3308e16de161f7c465f2eca4eae467ec7e5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311613, "uuid": "f01c1e13-ffaf-4dde-9bc4-ac9fbaa70017", "comment": "Malware payload (Heodo)", "value": "ff45ed2e8e3f2f15688a0d007927ac0ad231348d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311613, "uuid": "03c3073c-7d84-4128-ade8-3ffbd78a9d82", "comment": "Malware payload (Heodo)", "value": "b8adc8a63f21671e23f508e7ddd9d2266f71a55e9e91b1602be1fce065b4b6eb681c42adbef06d50c811feacabf0af6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311613, "uuid": "648e3006-7495-49a4-a280-add82d14f706", "value": "T132F46A936BC2C077E41F0279861AA2287257D5323756E6DF3BC1D75FCA387A2AB38141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311613, "uuid": "dd27f248-0f82-4b31-8404-72531c3406d5", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311613, "uuid": "b7090220-44b9-4a29-8507-4558366977c9", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOYJIOD7ZjAjKL7mYYlgV0C:w5aYJIwPHmngyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648311613, "uuid": "819ec26e-a491-43ab-863f-9b99a0381ea9", "value": 756760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648311613, "uuid": "7fbc7eb6-4532-4a56-b395-0127511f517b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311613, "uuid": "d5057015-8f96-41f8-b536-91829364d979", "value": "emotet_exe_e4_8ae44676b3f76205726e336145dd3308e16de161f7c465f2eca4eae467ec7e5e_2022-03-26__162007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6e5315-ad3d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648323857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648323857, "uuid": "168bb5cb-5319-4c40-89b7-694706d0ef00", "comment": "Malware payload", "value": "1b452a2c9b69ea8f8eacfc0f79271530", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648323857, "uuid": "06d710fa-662a-4b8c-ac06-5436ee786879", "comment": "Malware payload", "value": "8d0454eef2595f2fad70cf0e0232a7e336264911e3655958dc14e2cecc664c3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648323857, "uuid": "309e2766-e362-4d29-98e0-1e1f5883f287", "comment": "Malware payload", "value": "1b593b9b393ba078ff1d730cdeec08ea5c9a7814", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648323857, "uuid": "541c0196-cb68-4c3e-a9b1-0dd09531eef6", "comment": "Malware payload", "value": "d3d710481e937141d0edb4224680bee0411c232e47173732ccfd1e5174294646cebaaa65e91c06ffcba3f3c9907212ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648323857, "uuid": "4619a10c-f8f2-405a-b5c6-5a99353cb29d", "value": "T11A252353F39BD033FFAA27BC5F1D11418D2A7C602D101AE13692295D18BDA2277B5BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648323857, "uuid": "93aef621-ff1d-4383-8ca0-3181c808a1d7", "value": "49bebf76a1dd55aab68f85daf60aa00d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648323857, "uuid": "4c3994ab-b732-43a5-9b7f-2e0132a0e1e7", "value": "24576:B2VyGFxUgx1uyvX76CCehnGlM7AoqOaU:B2QgP7vLuehGlvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648323857, "uuid": "93c69587-3d76-4663-8a03-4fdba15d68f5", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648323857, "uuid": "3d353538-7f65-4d6b-bb76-82bf11037094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648323857, "uuid": "7f2bf563-3880-485a-b605-37a6ebd08d36", "value": "fusion.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23108d90-acd5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648279195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279195, "uuid": "47f1440f-58e7-4dc0-a008-1f9f919a5501", "comment": "Malware payload (RedLineStealer)", "value": "0dd5538d3f75306ec9aaff6cfcb74bfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279195, "uuid": "c769cd03-5fb4-453f-998d-85557db44f1a", "comment": "Malware payload (RedLineStealer)", "value": "8dff78ac919fb32a7153abdd3ef9ae3aed5f0e1a65a6362f61d9e3dc90365232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279195, "uuid": "0b189d90-5210-4ab6-970e-616a0e7659d6", "comment": "Malware payload (RedLineStealer)", "value": "06c78ab76248e76b8f359bf566d9b8257c7b3d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279195, "uuid": "93f87dad-9d9b-4db9-9000-74d6bcff5f6f", "comment": "Malware payload (RedLineStealer)", "value": "3f98cf637d0cb0b97f9644a39aae70f1627c5828237cfb06e43543e63b44365ab572721b58a561971521474dae524cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279195, "uuid": "b08ea944-a46c-4c7e-87e9-c926bdcb76aa", "value": "T13D1533B3C052A31CE55C3A74EEA5310E4A7CCBAEC5B1741A2A57D7CADA084EED305267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279195, "uuid": "7839eede-83ff-4ea0-8633-484d677e7f2e", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279195, "uuid": "976c0ea8-5c49-4558-b073-bee851ee89fe", "value": "24576:SoG2wD9l5iA/kjovaP3I/FDKOpAFjy+he3BuyLM/rkEaHNYK31gne5qEd:SE45iA/YovQYNeVjy33B/LMDNaee5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648279195, "uuid": "3e27fdd3-2942-4653-8d33-7854e9fbb267", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648279195, "uuid": "3e9e4a6c-c2c4-4351-a0d2-de29dbb51835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279195, "uuid": "0380f662-6227-4fe1-90b2-df4ff83254c4", "value": "OfficialKiddionsModMenuV0.8.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9c3b7f-acde-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648283157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283157, "uuid": "fabb3a70-bc40-4f65-bbae-1127eae9aa8e", "comment": "Malware payload (RedLineStealer)", "value": "be3626b1c39f3bce06690b77ad257dd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283157, "uuid": "c6333953-6299-4e53-93b5-4d968f5e4dfa", "comment": "Malware payload (RedLineStealer)", "value": "8e16230a9d5336fb1d6c6278b45e3b653aa2f6cd060742f28cd68d6a5117a396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283157, "uuid": "96fc437c-9179-466c-bfba-28a38ab81e2a", "comment": "Malware payload (RedLineStealer)", "value": "728e50decae7eae198343d10a0c2bcc5022adb8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283157, "uuid": "b33f5f97-c66a-4910-bd6c-f5757cfe06c6", "comment": "Malware payload (RedLineStealer)", "value": "66eddbbdb50c2e2f90017a79a441d786db6a82330fe902a76c160a29f13a1db6c096b809e9c392dd16e3a3027eeafe14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283157, "uuid": "6058d28b-96ed-4615-9398-f874c9f613f9", "value": "T133F533A3AA191E4BF61D4D7FEE07E0000761A6EF5AA713634CD2017BBEC8294C4E54DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283157, "uuid": "3f490e83-63b9-4fc7-97e3-b295d1c7d1ff", "value": "84bb1ac192dd1d591766b467b12ade64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283157, "uuid": "a07c0e35-2178-4747-a154-50e236f54792", "value": "98304:K9ckJgZJBx32c8a3TiHPBeZRuyO7AqY3UkWcT:KmRDiHPBeZBOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648283157, "uuid": "08972292-42e6-4041-8869-eb064e17e9ec", "value": 3326464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648283157, "uuid": "21a96b2d-4cd3-469d-b553-68d046ecd623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283157, "uuid": "2ef61bce-b6eb-4975-b1aa-7728477f1991", "value": "be3626b1c39f3bce06690b77ad257dd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48f7a2f-acb3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648264837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264837, "uuid": "4e089a0f-61a0-4ee7-ac51-72a7a20374a4", "comment": "Malware payload (Heodo)", "value": "e43bd9cd738338f849f3384df6b1d814", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264837, "uuid": "a072401f-e03e-454e-959c-5296df05e86e", "comment": "Malware payload (Heodo)", "value": "8e3a31d192ca18e072ea99f924a50b9c4460245e0072c12f069e0ee6cb3f383c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264837, "uuid": "a6230d93-3c43-475e-bf21-1a504078bfb3", "comment": "Malware payload (Heodo)", "value": "df5d473ca69a1125709d532adee80200c5f02587", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648264837, "uuid": "4c560e18-42ae-489b-8cdf-5ba6966aab5f", "comment": "Malware payload (Heodo)", "value": "386c71a7fa1f22cb60a999b08ab93148a1de7143b1e233516edbd39bb9d7afb9170f815976806dfafde90ccba3d9f546", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264837, "uuid": "f087f802-20d9-4245-87a7-1ce071ae0390", "value": "T1DDD47C0AFFD0C0B2D36B123019D5D65923ADBF2CEA61C573B7A8BF1D69316C18522B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264837, "uuid": "6c08cea3-899a-4b89-9aa2-69e01256d299", "value": "d63ab94f4bb6b5d2f0f6092bf07e00ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264837, "uuid": "24c3107e-f6ed-455b-9fec-97da34dc0c1c", "value": "6144:/6ZMFXzqfoZvMLd/mvcQYbi2HN8CeDwfO7y7IcuVqrN3ChLRWN7Ypsi6Ih9vH0/J:/8MFX40vWYvcQMNc0DZCBJjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648264837, "uuid": "8ed6d683-2501-4cee-bd11-9e8bc02b7f39", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648264837, "uuid": "70789012-b637-4fc7-9d2a-299feaba2c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648264837, "uuid": "2aeaae9c-11cb-4cd5-9bc0-1375dbc583d0", "value": "emotet_exe_e4_200f38dc4a6063c30a858cae82be2c4653953272c9bb8ad11b76e2cf101155eb_2022-03-26__032032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996e70d2-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648310747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310747, "uuid": "eb6835e4-774d-4d50-9e0f-70560c04b622", "comment": "Malware payload (Smoke Loader)", "value": "4eb7dc0941b40ad0fbd562109dd812e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310747, "uuid": "9a65c6e1-f0f6-4264-8ac7-8cd2ead21988", "comment": "Malware payload (Smoke Loader)", "value": "8efb5736edb66f0e32978e94238636b1b497ed3f206f9eb2cf45af9424a7cb70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310747, "uuid": "8eac3909-2ccb-40ff-9601-a55cbdc9f792", "comment": "Malware payload (Smoke Loader)", "value": "1dfd0ace766486372d760109b0c611b2db160257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310747, "uuid": "58f2bc6d-4ca4-4b99-be8c-ca54d1eecaf2", "comment": "Malware payload (Smoke Loader)", "value": "0f8f5f7a6c1d700bf46b4ce3c0521051c4ef3d6242ea8d1e05c70f900308849bf9ddf6598f69d3104598d6274ba212d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310747, "uuid": "65e03f91-7ba2-453d-9fcc-afb87e6316c1", "value": "T13724BF227990D072C45B16317479CAB02A7DF83503A549CBB7990ABE6F303D263FA75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310747, "uuid": "1b062228-d267-4651-9bc9-ed66524045d9", "value": "2bdd43acf181bf5b35cc83a05996f85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310747, "uuid": "7aad7ab5-92bb-43e9-bded-8e57394c6c68", "value": "1536:REVKlm3/xDJrs0DQOirxoOIL5FmcP4APeJZzEb+JOAy65zTdu6izEd:6VKlm3vUSFRlmnG+JbF5z5g2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310747, "uuid": "445f8229-d82b-4f52-8d4e-a2db13fd2b64", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310747, "uuid": "fa165dcc-4657-473c-a033-2e3686b3fdca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310747, "uuid": "fad2e29d-cce3-4235-93a4-4c20de0d5850", "value": "4eb7dc0941b40ad0fbd562109dd812e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2c9742-acc4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648272100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272100, "uuid": "0a272a9a-e987-4ee8-8a10-d47a2f9ace1c", "comment": "Malware payload", "value": "cc1d5b16bd317715650cf9710b5d547d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VTFlooder", "colour": "#27E55B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272100, "uuid": "3611b3f4-5ce7-4fe5-b5ff-ac39818be9ba", "comment": "Malware payload", "value": "91ab03a15d3af5b110235d49b75dec907d88a5b3558b1fe049f6f354709a1160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VTFlooder", "colour": "#27E55B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272100, "uuid": "9935ecf7-e0e5-4f77-bbde-f60c8a13ac2f", "comment": "Malware payload", "value": "6625ec6db52701b5705c1bf313603b78ee55bcbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VTFlooder", "colour": "#27E55B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648272100, "uuid": "baaad956-80b1-4f2b-88b1-732ebddbfed5", "comment": "Malware payload", "value": "67f055ef55dc84fab4dbcfbd9c56a085a4ca7acaa6f1aec3d920a438d211f37693c4fae006d01ec3b2a50cf4ae0bea8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VTFlooder", "colour": "#27E55B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272100, "uuid": "1b9cfe5b-c589-4439-96c4-9d6651986fdb", "value": "T1DF531A01B69194B6E1AB0236012945F4527ABC74AFF042F73DA6774EB8B1DE08D39F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272100, "uuid": "106ee45f-b1ae-461b-846a-f54978e72e64", "value": "3d8c26f4cb1782a87c3bb42796fb6b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272100, "uuid": "83b4592b-ae89-41a2-87b0-1fc2cb7b7525", "value": "768:TAPQZ6964APsED3VK2+ZtyOjgO4r9vFAg2rqT:TAIG6XYTjipvF2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648272100, "uuid": "4e7a3f37-085b-4c13-99f0-c3e630e4992e", "value": 63310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648272100, "uuid": "7bd2ccb8-86c6-4732-b162-0ad884901b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648272100, "uuid": "2ceb7aba-b2ab-46b9-b88a-80c1814ef704", "value": "TIRED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83339d71-ad04-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648299543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648299543, "uuid": "76c8e532-9b7b-472b-be4a-32747bbb8cbd", "comment": "Malware payload (Heodo)", "value": "0975d9440889c7a6359fc982518fd061", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648299543, "uuid": "ad0e4cd9-67e1-4d06-aed9-8c8731b99b9f", "comment": "Malware payload (Heodo)", "value": "928988ca665186f630c017a87f9d4f9bd085cb92dad687ac20568bb4903c1458", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648299543, "uuid": "471185ee-c2d3-486f-8945-1f0f5b0a8229", "comment": "Malware payload (Heodo)", "value": "d0435f65929334b2349f1b9657603721385acd71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648299543, "uuid": "9c546c4d-082c-46d0-be69-c7135fb95dc3", "comment": "Malware payload (Heodo)", "value": "158f7d0938047ef970e230cb5a7ea48c4b5a5333cead5456210501a9e38bcb9d2d233cdad20f11bcbf99adb7acee1386", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648299543, "uuid": "edcb8d4f-b52f-42f8-8f95-2ea4d894d381", "value": "T1A5A41A51A5538073C7FB25F2CBF152B766D5AB91C72B452E02A8C13F7A28E437762E20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648299543, "uuid": "7ffbfab5-bb89-4dfa-b476-d7152f156c15", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648299543, "uuid": "fd46f815-e3ad-4d96-92a3-394a17db0c27", "value": "6144:U/L5tYtXZ1BpFHyFjJmP/RbV1M2lvMOeL/grx2Xr3GzOi/r9WHkv:UWBpwupxl0OeL/grx+GzO+r9Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648299543, "uuid": "023f4c20-3718-422f-a868-711bbfc64dbe", "value": 458132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648299543, "uuid": "8cb58c1e-7978-451c-a227-a4c6ce77cb8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648299543, "uuid": "74da10e4-0393-4ecd-a5e9-fa147f97c5a7", "value": "emotet_exe_e4_928988ca665186f630c017a87f9d4f9bd085cb92dad687ac20568bb4903c1458_2022-03-26__125858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a2a640-ad33-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648319809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319809, "uuid": "61c91da3-6e60-417d-bb4f-8564261240e9", "comment": "Malware payload", "value": "15bd7e881b1430cd87d9264e9e86f8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319809, "uuid": "bf52f020-c47b-48d6-8ec3-074109f78784", "comment": "Malware payload", "value": "93b98e1a3801eae8c3a1f9a34b8172bf6e026413f4fc1a8500093eb8760dea31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319809, "uuid": "86cc49a7-7d36-45d8-8542-fb9c34cdc80a", "comment": "Malware payload", "value": "cc24dba3fa3dcbc457be618db647911cffa03843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319809, "uuid": "f7e05253-9df6-4047-9133-6c414eb93614", "comment": "Malware payload", "value": "7602259059b090cd014de8b441e21184c024b75b7793ba13be57b68d624b87758a8d9f9540dc49ecf5b18b44d3fc90d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319809, "uuid": "60ba3ff1-7068-4138-afa0-63e4fbf9a91d", "value": "T18314AE41E3E4CF86DAB21A311220DA705936FA996A46E79AC4DD3C0F3F97754C4E0B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319809, "uuid": "0bfaee38-1e8c-4c1e-869a-90f764de88d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319809, "uuid": "0014a0f2-73a1-4a36-8d2a-aecbabf3b764", "value": "3072:zAeZuravljDu8rC9gDrgQfcnVC5WWUSc1pKpu/MAI+6Ifwgbk8nb7zl92Nv6cHr+:ROav5TrOdU59ZGQJBIxbkGvhm5r4gWKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648319809, "uuid": "571c415a-67a9-49d3-8d38-0029d016fac1", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648319809, "uuid": "88291f7a-bf3d-48ab-9c17-3d23f7a589c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319809, "uuid": "cd1ad284-95cd-48d3-a2d3-b22541e9bf12", "value": "BeavisBot Updated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd22f9e-ad33-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648319853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319853, "uuid": "edd16a66-07a5-4c94-9ec8-c66bd56f924b", "comment": "Malware payload", "value": "f9255ed7e63eac58bcb1f6f1914d2d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319853, "uuid": "5cd0fde5-7083-4055-a8c5-ac60e539ffc5", "comment": "Malware payload", "value": "986558345a3f9739e0b1eb8cda0997bf2d0a6539e21149124bcbca7cf8046dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319853, "uuid": "57ab6d55-c55b-4748-b14a-94a8f9631059", "comment": "Malware payload", "value": "7bfd5349b94e9e09e8d44d3db4d919f7c3108fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319853, "uuid": "3df9b691-782a-454c-9e40-c0b490fb749e", "comment": "Malware payload", "value": "0b8fd5d24c9fb8d749ebbeb0e7d564e6313e0cd830f926b7baa77a3d8bb0115b19febd2d781188fae3901f4424c49682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319853, "uuid": "a30b72c2-1a65-463b-9d9c-4c10adca9dac", "value": "T10C54F0126A018858F74D0F719A92F9E01A548E3C84E4F65FF13CBE3668322D799B758F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319853, "uuid": "8874c8fa-8b8f-4e38-be36-a88ba5e5ec12", "value": "29a447a303a6cf8357c37331ad3593c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319853, "uuid": "570990de-89d5-41f0-9c0b-fd0311059c0e", "value": "6144:k9o3g6pDPeVvnAmZ64XMxfQ4x1OpGcm9VQl0lM/oJ4/guZXE:ooXpK2y8DzkGHVqoq/g6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648319853, "uuid": "aeb6c348-62cd-4ea8-ae2a-1a31460b8663", "value": 299466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648319853, "uuid": "e1c9a798-f272-4440-817a-61f6682105d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319853, "uuid": "7c4f1298-5b31-4d6e-9a00-f2190f5cc483", "value": "generic3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef2968f-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648277095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277095, "uuid": "bc14e2d0-3053-4795-a32e-64fcf15ebf72", "comment": "Malware payload (SnakeKeylogger)", "value": "e67d1612a59d915d56d5ec3b06b77444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277095, "uuid": "362e196b-bd19-4339-8d2f-c4f7c020ed4e", "comment": "Malware payload (SnakeKeylogger)", "value": "990d691160c40a201f846ebc00d82856a279a2dc6e4c6e4e7b69ed03a6394dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277095, "uuid": "c3d90f79-eb7c-48a3-837f-a545c5faab57", "comment": "Malware payload (SnakeKeylogger)", "value": "b0113c1d5bd57edbc37f14c5de515fc15d458977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277095, "uuid": "9fb158e8-ebd1-407d-b22e-d7ae2e3be4d0", "comment": "Malware payload (SnakeKeylogger)", "value": "960a97046893a5350d2d3858c5fdcbb2ef9c46f037b827ec856ba79e905a92208f70b3237177e361fc406b0bdc0a9d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277095, "uuid": "bc778998-6c3a-40f9-b1c3-aff0d716e2b6", "value": "T1832512562CC1DE12C4750B304D76A48CEB35E366314C96A8B8DD323B9F22BA15B77BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277095, "uuid": "12972668-0310-4442-bcd1-df7616341522", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277095, "uuid": "3d9ef3e5-042e-4548-942d-c7c22ed2b2d8", "value": "24576:EKHh72I4uTX8WbXxnCak1VW8fCh3hXSBulf0MOTNk:EA6IpBbXxnCaEVW88340lfJOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277095, "uuid": "57772d42-2536-4819-9ec2-0788d1b83ead", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277095, "uuid": "d72fa05a-5421-4c9f-b679-458953b890c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277095, "uuid": "8c67bdcb-5f93-478d-9167-bf4cedb7c135", "value": "Payment slip.PDF2021-03-25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3682e9-accf-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648276845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276845, "uuid": "807290ef-35e5-4fe2-a050-cc1babab2d1b", "comment": "Malware payload (SnakeKeylogger)", "value": "983bba8b4eaad9a176488a18e2cd4e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276845, "uuid": "76459e32-6757-4650-abf6-265eaad3c6db", "comment": "Malware payload (SnakeKeylogger)", "value": "99d74ca453ad2f28a1516acc4cee5c9f0191284cf39f6513f69f123a4ad9825e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276845, "uuid": "41cf07ca-f997-4ec4-90e2-e318725e07c9", "comment": "Malware payload (SnakeKeylogger)", "value": "2b5e9e0a0f82cf7debb6b3e8fb469bbf5d3b7efc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276845, "uuid": "ab5ab115-1d66-4d75-ac7a-e2aac46b37b1", "comment": "Malware payload (SnakeKeylogger)", "value": "048fd64adbe54ce405a04e1e36878e6eebb1ba2421d05d08fa0daa0f723d1f767d22bc0279e3e07df6e3e9c26e62bb3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276845, "uuid": "f243d9e9-0771-4b86-b99c-435363b6cb69", "value": "T1B7431883E6C48311E8244970653B5E381736BF89EE42750A31DCF51B1FF77C6A92296B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276845, "uuid": "268d9695-c1c1-441e-9eef-16e17a3f6782", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276845, "uuid": "33a54a7e-821b-4d32-93f5-bbb37073f4b4", "value": "768:IvB/mvwgQxiK56WHCfUHQwP0Z//amaOgqxsCsoKZo7K:IwvRK5Vh0FaOgys1jZo7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276845, "uuid": "54acca45-616d-4737-83fb-68ad8e82e320", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276845, "uuid": "b682c874-0666-455c-9c85-e406912f7cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276845, "uuid": "4b15d324-362b-4838-98fa-2d858c7d10e1", "value": "Swift Bilgilendirmeni.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dcde56-ad33-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648319843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319843, "uuid": "7473d541-cf1e-47b4-a30f-62c69cf8227a", "comment": "Malware payload", "value": "d635cbf07a033ba1442edb5014df85ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319843, "uuid": "7a904a30-70a2-4f9e-9753-ca5ae3ca9478", "comment": "Malware payload", "value": "9cd158814f59199b2ebd55da159dbc651b696e52c6987abb43b1fe4649d14079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319843, "uuid": "c9b6536f-de1e-4cf8-9660-c82a70d1d4a0", "comment": "Malware payload", "value": "5dbb6fb226eb73ae68915e228d24b9c06a1d0404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319843, "uuid": "af625023-e2a3-4a85-92d3-3df619ede656", "comment": "Malware payload", "value": "38f8d5f760327a7d5406c9b8c6185912ed3d9c71de6e304dbdd508fc41bc15dedd3875bbc7f532c041cc43e5b6eefae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319843, "uuid": "782ad4fe-6eda-4248-8215-83ecb5af32ee", "value": "T158E37E43A5CCB576CB9B02372A94DA3811E82190D7484B02FBFD397ABFC6AD1358E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319843, "uuid": "d21ac64d-cf51-4aff-896e-260d9960f5bf", "value": "4753904c40d638a1bc745c65b88291d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319843, "uuid": "3c8c80a3-683f-423f-92d6-fd8c94b80328", "value": "3072:Mp3DpqDpIDpCDpIDpoDpIDpCDpIDpJDpqDpIDpCDpIDpoDpIDpCDpI:23VqVIVCVIVoVIVCVIVJVqVIVCVIVoVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648319843, "uuid": "0ce0c7c6-de6f-4678-a0d5-7c31a2531375", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648319843, "uuid": "26dfd9f1-e19d-4c1c-a8e3-5af547b41566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319843, "uuid": "1350ce49-fbb4-4867-b0eb-87f3e75ac2ad", "value": "generic2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada79d8d-acce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648276421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276421, "uuid": "e262a460-21d9-4659-b19e-e22c77d773fc", "comment": "Malware payload (Heodo)", "value": "ec11e907a71051100d2332ab314cb858", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276421, "uuid": "2478569b-c108-46aa-8e3d-ebdec5be4aba", "comment": "Malware payload (Heodo)", "value": "9ead0ca4667c787fcb97363aae80424ae86b5ff416eb652718c8e7e311ff2dbc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276421, "uuid": "4d9566e1-e822-45d3-81bb-74ea179f74a4", "comment": "Malware payload (Heodo)", "value": "b72d3d635cb07bdc99e6e90eeefec88b832bb5e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276421, "uuid": "3a899624-4145-4468-8b78-d8681ca60091", "comment": "Malware payload (Heodo)", "value": "6c957a57823e173049c7b892f31dcf8df2675e76c4aecd4793dbeb26c07d8eeddbf01caf7b8251dd8b73a84d39f21614", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276421, "uuid": "b3ea7c01-2a34-4bf7-8214-4b23bd188c12", "value": "T19FB44F7D1FAE0062CC621770146C0FD991ABCA25BB2259FF64852E2E2EB57C74879F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276421, "uuid": "7d16fbab-44f9-47a8-987b-0d611562b8ee", "value": "6144:iKfJCALkjp1g4SbsLyKilbNUBmB5XORDlsOMAidDNk:iKJCPjp1g4SbBKilbUD4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276421, "uuid": "8cfcd041-748c-4049-888d-8ac2908689e3", "value": 507418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276421, "uuid": "ffdc7926-b9d0-4a8b-a203-77855dd3316c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276421, "uuid": "09bbfc2b-b40c-47af-8a33-267f3982d45c", "value": "emotet_exe_e5_9ead0ca4667c787fcb97363aae80424ae86b5ff416eb652718c8e7e311ff2dbc_2022-03-26__063336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c3ca56-ad1f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648311164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311164, "uuid": "90a30a0e-8360-4e64-93bc-9ac1d3178971", "comment": "Malware payload", "value": "8781bedb05c9d9ec4e86f4bc43fe95fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311164, "uuid": "8fb5b5b2-2ced-4deb-8e92-9311d4ed3f1c", "comment": "Malware payload", "value": "a050077b84a7641fa185259c8e879258d5c8d0308a8c1ee1927fea7b16889103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311164, "uuid": "41bf29a8-5647-46cc-ac33-27b5a1832e5b", "comment": "Malware payload", "value": "1785512c1d30385a7097c5df9355671d5334de23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311164, "uuid": "a5d31a9d-0a06-4cbb-bd85-743dbca4117b", "comment": "Malware payload", "value": "d9cd0f7e059306ef40395094fc6e22c9be9d14a66390e05ee47e332d830177d2f5f29fcef2ba020ca6633c73fc155843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311164, "uuid": "b044dab4-a215-4ec9-b505-b79772f4de1c", "value": "T16406AD02BFD18F2BC5964B388AE783647379DD904B43575BA349B1293DB23E42B871D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311164, "uuid": "6cd17b6f-6a00-4ac6-832c-b7ccbd147e90", "value": "24576:jnNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcer+5kwEK:LNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648311164, "uuid": "0fc9d854-1660-488b-b5cb-bfca2d6ade33", "value": 3842729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648311164, "uuid": "a3ff051d-7497-482d-aea6-4b8e500cba2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311164, "uuid": "73b19acb-2740-4ec5-91d4-a17050712ce1", "value": "8781bedb05c9d9ec4e86f4bc43fe95fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcad424-acf7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1648294169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294169, "uuid": "5cfe71ba-92cf-4af9-9a09-50fa698a566f", "comment": "Malware payload (AgentTesla)", "value": "95a4581437eae037cdb370ba252477a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294169, "uuid": "14db4906-468c-4e9a-a3ec-5b620d8ca29a", "comment": "Malware payload (AgentTesla)", "value": "a1732747d99c1d6c6cae225bd125a41e6c39f868ecfe54ac0e0c4c21f7573d50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294169, "uuid": "bee81766-5d99-4227-ac2a-507c70cd7e3a", "comment": "Malware payload (AgentTesla)", "value": "b5220ffa6bbca3d55637c2b693f9f5b1d56b4e84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294169, "uuid": "21679b0d-aab7-4615-8b26-95c6263d4535", "comment": "Malware payload (AgentTesla)", "value": "43ecbc192418ad689227b91ba0f0d6771fe5616008e3704cacb4f60e6ed5e04aedf8af7af594d3ee43daa6b50d74d077", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294169, "uuid": "4f359941-9c1b-410f-a4fd-bd03d288c05c", "value": "T14E2533B2ED0DCA269F84F4AE9A6CD0524E5F85468F52C7031678BB3810194FD47ED3AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294169, "uuid": "6bf6305a-8902-45e1-89de-329264ad8e1a", "value": "24576:FImLP4PSI7PdKrHQGXWLF9t7xqbM01wJ8fLyo84xipog:lI7wLYLF99xUxn84MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648294169, "uuid": "a5db4df1-80bf-40a7-9ab8-24c9374286af", "value": 1011315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648294169, "uuid": "77f3ece6-5798-4a85-805f-14ae81f9052a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294169, "uuid": "b04d9adb-2b8a-48ca-b8b7-39ed22962e15", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ceedb4e-ad1f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648310995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310995, "uuid": "15d62670-7d7a-4765-a509-8a5249cd5791", "comment": "Malware payload (RedLineStealer)", "value": "bf5583a1b318ba14bae72e9fa7bb8a6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310995, "uuid": "0740d2a5-11c2-4dcf-897f-6ccb70ed626b", "comment": "Malware payload (RedLineStealer)", "value": "a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310995, "uuid": "85828b6f-b76e-49f6-bada-50bb09e36985", "comment": "Malware payload (RedLineStealer)", "value": "4cc2567863cb1f440cffe323fe85aedc1250ba61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310995, "uuid": "022c4bea-483c-4c19-ae76-d7d44a242c58", "comment": "Malware payload (RedLineStealer)", "value": "5575a1206ba040a9c9d13db40dc209b469c944aab42cb8db0385a075564391b5e9f1248413d006b4f13d6e1cae153eba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310995, "uuid": "19668a31-9d6b-471f-aff1-438b3cd4afb4", "value": "T1F424C0223291D031C44B16317865CAB46E7AA9310FA5094F7BAD1A7F5F303D257FA74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310995, "uuid": "1e7cf1be-ba22-485d-ae3a-6cd5f0d5aa20", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310995, "uuid": "e5aded7b-f379-4da9-b5a9-da50a607cb52", "value": "1536:V1KbWS7VT4WdAGkDJWtrb0Ojm3dTKJTDU9mYGhuAjJnn45lSQN4OYEuDzx:V1KbWRmqBKa96ZjJ45lPtY1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310995, "uuid": "f45523fd-0f39-43f7-a141-e31de7fa1ce4", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310995, "uuid": "3c23635a-c5ce-4b9c-ae1f-83a6ca37bef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310995, "uuid": "e92084ca-90ef-462b-96a6-2be4baf899af", "value": "bf5583a1b318ba14bae72e9fa7bb8a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b903631c-acd1-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648277729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277729, "uuid": "87692fe4-fc19-4a63-8952-13ebab6c1402", "comment": "Malware payload (AsyncRAT)", "value": "7667aa8e9f1ee16660cb442d015a112b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277729, "uuid": "336316b7-28a7-4ad5-ac81-1b5e84832cd8", "comment": "Malware payload (AsyncRAT)", "value": "a503086b711671ddb47e256b6dd53a30f0eaf2110374a72ca676ea78a37ba6d6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277729, "uuid": "00f49f2e-2d00-460f-8ef3-973ad6210468", "comment": "Malware payload (AsyncRAT)", "value": "dbe6afad6c704625cd616b1c047f091494bab5e4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277729, "uuid": "114059b0-6ae8-4539-bbdd-99f215c5e127", "comment": "Malware payload (AsyncRAT)", "value": "87cc72670fe5783a24cbeaab5b0d1bbe4cc4ccfc8f00d4a45ebffaf040664cae445b11a7ab70d64d1cb763bed480fa18", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277729, "uuid": "87de3dc1-6c10-4770-b30c-5437d8a86e13", "value": "T1FF620BFE9C64DAED1522D9C98C40829FC4127D0FD1B30B38A42B78D57B73A42B95CD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277729, "uuid": "cde026b7-75a8-452f-885e-aa45f2473d03", "value": "96:7eeeeeeeeeee8ZCyjPZCyjPZCyjPZCyjPZCyjPZCyjPZCyjPZCyjPZCyjPZCyjPT:7eeeeeeeeeeeiBeeeeeeeeeeey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277729, "uuid": "b835cce5-97d8-494f-b832-82d0c869a62b", "value": 15785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277729, "uuid": "92c845f1-0a34-44f9-8976-c856bb9ebdcf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277729, "uuid": "5b140a5f-585c-4310-9546-8b46ba934b02", "value": "Votre_relev\u00e9_fiscal.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86998276-ad07-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648300837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648300837, "uuid": "ea1db4d1-f8f2-4ae3-9f9e-d50fd7e41faf", "comment": "Malware payload (Heodo)", "value": "b91328a0e03cf211ffbb3287368ec57b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648300837, "uuid": "abb52b50-bf60-4449-a11d-979e8a6dfd94", "comment": "Malware payload (Heodo)", "value": "a58cccd9a208918770ab2f92bfcf0bd16c25c7e007a526dd8dd8885d7c3b4e2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648300837, "uuid": "fc281164-bbaa-484c-8390-8768efae1758", "comment": "Malware payload (Heodo)", "value": "7558ca8dc7068e51fa45b3e5e39ab4bea0d21f7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648300837, "uuid": "e49488b0-2866-4b18-9154-4ca6d83ba0da", "comment": "Malware payload (Heodo)", "value": "296bb8460496b628049e8c5d9386a92e2e1790de54944c9a5aa57aed752c4ccadb10d81df5ec2cfbb0c58892475fdc72", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648300837, "uuid": "dc2c5d33-5f72-49a2-8695-414bfa0a4626", "value": "T1F4242F51956340638BF76AE3DBF521776AD69B81C32B093E0179C43FB628E437792E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648300837, "uuid": "ac4f4caa-548f-4e1c-9343-5fc40e5c785c", "value": "3072:Pu3zSmuSHHfI/USrrg/vzXqGaesLQ0TxPejjDK/fvS+jWhyoDDTDDCDDYDD7DDVC:U/L5tYtXZ1BpFHyFjJmP/RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648300837, "uuid": "464f3364-9f86-4367-9dc6-c941625fc899", "value": 212405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648300837, "uuid": "8d5ddd43-b90f-4251-92b4-7f94726e602b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648300837, "uuid": "7bc01d88-4a6e-4fe7-8274-c18b17295b5f", "value": "emotet_exe_e4_a58cccd9a208918770ab2f92bfcf0bd16c25c7e007a526dd8dd8885d7c3b4e2d_2022-03-26__132032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17e7011-ad5b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648336960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336960, "uuid": "340d7d31-af03-434c-b2c3-7c2f65efbeb2", "comment": "Malware payload", "value": "22a189e0266e0ad722b7e58923eafab5", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336960, "uuid": "73386f6e-2b12-4981-b77d-1d4767545265", "comment": "Malware payload", "value": "a58fa03638110727f4a4a227f6ec2c0dceaeb39ccee89d12a4d727bb50d29dc0", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336960, "uuid": "6175a522-5616-450f-8f94-59fcec5e795d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336960, "uuid": "85331e45-2af9-4078-9242-fddb3684ed48", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648336960, "uuid": "0721d535-8fbb-40a4-a0eb-5a9c7c489639", "value": 11376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648336960, "uuid": "cf282023-f462-4ae5-8ae2-fab52d1ab81d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648336960, "uuid": "9df8b436-edf9-45f2-9997-a051c3b7b4fa", "value": "lh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6852a7a-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648277322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277322, "uuid": "223552af-2ba6-4b00-825f-6bdf8b3f3b16", "comment": "Malware payload", "value": "a8b2985211d581379dde0a828dd317a5", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277322, "uuid": "bb744969-1f22-4cc2-87d4-8a22bf5b4ae3", "comment": "Malware payload", "value": "a6395c661878a7d7c0f6fc7549e8432794e15e1ef322f557c8dd465fc1d404c0", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277322, "uuid": "63763f59-53fc-4bab-bda1-77be8cf0eb05", "comment": "Malware payload", "value": "0387a78c0b832e6c725fb69d011afde58317a680", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277322, "uuid": "7916db96-79d6-4fe0-839c-832a020565bc", "comment": "Malware payload", "value": "ee367e6319d8b925e0e3bac87fc2ee29c3bad0291d7a578ebfc4b77ee1c88a296615af2a267a110e13942aefd5fce745", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277322, "uuid": "a7aea7e3-f115-4682-9ca2-cd023190d3a5", "value": "T11C141293D2B18AB2D6392BF497C4104D46F4EE0AA4148627D436BFF9E170FD270BB652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277322, "uuid": "37562c3e-e865-4f96-be19-7ac40a281cb5", "value": "3072:78vLS5Gf7VXAvryInSn6RyxIA/tnR+VC9V3oIauNmDDq6UDUXNtEPafoVY8vkwzM:P5MXQuCtyxIA2kV7NmDDDsUXktVH4Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277322, "uuid": "7b24bd03-51da-4806-b493-09f8e2eb28c6", "value": 192888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277322, "uuid": "2038b8c5-9db5-4b0f-a8c0-37f24478ea4b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277322, "uuid": "9b649f62-c7ed-468b-b8b0-fd5cd5d074aa", "value": "order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b97a62-ad2b-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648316405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316405, "uuid": "10ddb332-c832-40f0-8ab0-c6dcd83c525f", "comment": "Malware payload (Smoke Loader)", "value": "1580f367bdef0bc3a315e26a859c42c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316405, "uuid": "64c01f34-4df6-49e3-9195-eed1e0558c46", "comment": "Malware payload (Smoke Loader)", "value": "a63b9c4ed6d83aff1bf47215f3297d5fb1cd85e69a24deac6750d511f61de055", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316405, "uuid": "fd68a512-e7ed-4062-8bc6-60118eb85640", "comment": "Malware payload (Smoke Loader)", "value": "e5e6735135dfc131eae124eaaed317590e6f1a18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648316405, "uuid": "5be686d6-43e6-489d-8960-901288cee2e2", "comment": "Malware payload (Smoke Loader)", "value": "8657b308d7ff93545720cc8614e2a0b8e0b7245acba70609a0177aa9dbe024ebaa8a329e2fc9a6b1b1351ad8add0378a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316405, "uuid": "ab57ac91-4a2d-4772-86d7-83e314b39af8", "value": "T1C234C0227590D032C05751357469CBF06E7EA83213AA598B37AE1BBE2F703D14BF974A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316405, "uuid": "270a33ff-1006-4797-b57a-7baf3d497f7a", "value": "487134aabf70de91adaa596b972e9646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316405, "uuid": "a0f97721-8488-4b57-b5f1-d0eb6ec0b696", "value": "1536:WJ6uE35x19d26UjjwtKI5dsp2wePhVMzV5+R2eyqRETlNokXFWmZz59NT6zWsD:WJ653s7jxNOVQ6JilCqFp59k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648316405, "uuid": "ff045522-0165-4c25-b6f6-38fe5d6bef15", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648316405, "uuid": "7d55113f-835a-4937-9341-a3aa26c3fa6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648316405, "uuid": "457d1372-6654-470e-8ad0-0c234130775d", "value": "1580f367bdef0bc3a315e26a859c42c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa577596-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648269249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269249, "uuid": "e0bbae45-16a2-454b-bc1d-8884d53b6bb2", "comment": "Malware payload", "value": "f7af34ec1396c7465a13e2cff527b74a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269249, "uuid": "30744525-6769-4e3f-8766-4cb2508b2c9b", "comment": "Malware payload", "value": "a744588a8b150975568555da61bad6eccccab06ce8831f11173ac2dc03cda129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269249, "uuid": "2a05921f-f3ab-4fda-bc01-0fadbd07d893", "comment": "Malware payload", "value": "cf14a7ed5d19b46a12fe44d2d32cabf0a4aec741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269249, "uuid": "85706f7d-9237-495f-b4d2-8d3b73c3a55f", "comment": "Malware payload", "value": "69f095e69cadcdab0d9492185cc72c888a31ec6440c4cd77eda7db3a12afa5308085cdc54d246e868b2e0ecf3d1c2cf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269249, "uuid": "39e2952f-1723-496c-9d8d-bb4c696438ae", "value": "T13453BFA373D0E0F3D4A2037058729A76AFF6FD213195174B63882F5978734934A2F666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269249, "uuid": "3a79cb60-0c5e-4228-ae88-1bf3220408a4", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269249, "uuid": "3f3e8301-d14f-4c46-b30b-b35783945c7b", "value": "1536:n04f1SMHjZ0k/tB1g//I0DuoxbxAHscy4RyPfy0bwRQsN5xgSm:tf1BDZ0kVB67Duw9AMcyZi0b21m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648269249, "uuid": "d0f48c9d-c904-4e8d-a38e-1a110285beb9", "value": 63706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648269249, "uuid": "c946ad0b-cb7a-4728-88d3-3694109e7650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269249, "uuid": "ee8b8a10-b9c6-4848-9881-3ed941fabae6", "value": "misfits.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3361e33-ad2a-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648315944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315944, "uuid": "364d8f45-ade5-4301-a628-3fd45f15868c", "comment": "Malware payload (AsyncRAT)", "value": "e83d86c5a054223284e4de94215afd60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315944, "uuid": "f6580b80-6985-49a9-85a9-4bcb53f010f6", "comment": "Malware payload (AsyncRAT)", "value": "a867473b1455e96aeaec26f73a6a4bd1da2528d6d4c09b51ed81d2425a70a1ed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315944, "uuid": "4a35027e-bc2f-4647-862a-f8163592f6fe", "comment": "Malware payload (AsyncRAT)", "value": "71c845e6ef07c56412e159cbf1950245f1760c34", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648315944, "uuid": "f5ec595d-3b9c-47ac-9edb-a1ffc47742e8", "comment": "Malware payload (AsyncRAT)", "value": "82e5457797128e95abc7ae1fb05d42fa92f5e58eeb770c744ec14a09f4a73b243712c0fcc1894e4de0bc44a3dc5ce0bd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315944, "uuid": "5d963b53-1abc-4aba-abf5-5ae9835319aa", "value": "T194232B043BE8822BF2BE4F746DF36145857BF2277603D54E2CC441975A23BC68A429FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315944, "uuid": "49664a85-3810-41bc-9e83-6174cec9c983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315944, "uuid": "e6c19aa9-e8ab-4a6a-af17-728f0c0da4a5", "value": "768:uuwCfTg46YbWUn8jjmo2qrA0wqd8jWjPIBcyOh0bFsxCBuFRMvK98OoLyKql7BD8:uuwCfTgp/2p5r/BcyvbFsx4uAKmORKQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648315944, "uuid": "eec1e24c-25d2-4120-9fdd-8c42e817f0e4", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648315944, "uuid": "9b38412a-cc82-490e-8332-6d2d65f523e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648315944, "uuid": "29758279-5bdd-4e73-acf2-fafb470b47ac", "value": "9hXttuK7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6259771-acee-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648290153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648290153, "uuid": "faf14d98-cc8b-4456-9407-9a29b0b834c2", "comment": "Malware payload", "value": "04af4d621f6b0dc55a98768e6134d423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648290153, "uuid": "bf6ced6d-453d-4931-b6ee-3af6fb5afca5", "comment": "Malware payload", "value": "a8df81dd1c84c1fa4ff82e3b26c19d1a010d2e4b20c5ade56d2f47092f51ef3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648290153, "uuid": "6b515417-194a-408d-9072-31f17b1be882", "comment": "Malware payload", "value": "e3bf9251891542199eef0db1e5f0a999c64844d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648290153, "uuid": "c4ae50c4-9e8a-425f-8ef3-c7de255e4b40", "comment": "Malware payload", "value": "8daee83611c788b635eebbbca2975f4ea7ded5fc2a25dfabb8e8f3b10c35bb79c51f889a54cdf4802791832c27ff40ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648290153, "uuid": "49ae16af-d8fc-42f2-9266-eb42f795ceb8", "value": "T15725232039D5C4BAE1620031EA517FD6D2FAE7180F32896337A56A3D5E7D981C73A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648290153, "uuid": "d05a156d-9996-4e88-95b9-fbd61cab2a3a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648290153, "uuid": "fdf9332e-113a-4789-a01f-566ff29adcc9", "value": "24576:91OYdaZfMtkSoH+1L8l7AGjqWiGrY9WzNX0XlD:91OsC6Ocif9rvNkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648290153, "uuid": "12edfa9e-4890-4305-b05a-b0152ea23300", "value": 989072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648290153, "uuid": "3f723ece-68fd-47af-a848-3518d95b210d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648290153, "uuid": "0b91242b-05d1-4050-8e22-de7df1d24a14", "value": "usfive_20220325-185303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5642e2b6-ad1d-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648310205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310205, "uuid": "fae6a001-7417-4128-8a1d-e759566236ee", "comment": "Malware payload (Smoke Loader)", "value": "a2f77ce2be9c159c37b6f20a48591ea7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310205, "uuid": "66428b07-250e-41b4-88ba-8904b671bfe2", "comment": "Malware payload (Smoke Loader)", "value": "a9bcd8d127be95c64edae5cdd2379494a37d458fd9d5881d74f8d5487a805e6c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310205, "uuid": "5474033a-d8cc-49c3-84fc-78012cddc766", "comment": "Malware payload (Smoke Loader)", "value": "55af8c010f3528d2d5fefeb0b0d4d4a80e88bd22", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310205, "uuid": "6883a1ae-cd72-4ea1-860f-7dde6da3dcad", "comment": "Malware payload (Smoke Loader)", "value": "19bf030566ebfb6195051d2d81cba9b72ed3e6d131337056b1c074682ab32c6876a221df0c04aae832f2b208a28fc217", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310205, "uuid": "869a1530-caeb-4de1-9099-d4dcfcf65d15", "value": "T12B24BF2236B0C033C45B15367474CEA47ABEA93117A1494F77990ABD6F303E266FA74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310205, "uuid": "31438d1a-fc6d-40f7-b354-54b674901f8d", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310205, "uuid": "d3e2a6db-bd43-4c14-ada5-edff1a2e2d3c", "value": "1536:FUKYzr7VT4WdAGkDs5trb0O/SG2JxfFZq2BFfNkBxoS450LiWC8Kzh:FUKYzCW/STZpBJGa50uW3Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310205, "uuid": "2a5d379c-66b8-4906-bb2e-9976bebfcd26", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310205, "uuid": "44cb137c-7f09-4adf-975c-d474b7dab323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310205, "uuid": "e51360e8-6953-4a93-b129-8b763da7de59", "value": "a2f77ce2be9c159c37b6f20a48591ea7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62ed448-aca3-11ec-9275-42010a9c0029", "comment": "Malware payload (ZeuS)", "timestamp": 1648258075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258075, "uuid": "523756e0-225a-458a-a239-5782e4dec773", "comment": "Malware payload (ZeuS)", "value": "b81c7b30ec90a12728fe62467e8c415a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258075, "uuid": "6d5112c1-81a7-4837-aa39-db03dd7b3ce2", "comment": "Malware payload (ZeuS)", "value": "aa0762d7122483c149976660ef7fd4ad159e037614e5b3ba7fdf6a26b90b80a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258075, "uuid": "af8bbd9e-d067-412c-a7c4-ae1ae064337c", "comment": "Malware payload (ZeuS)", "value": "710dfb202ef2f452614373b77aaab6bb1a20ae80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258075, "uuid": "2e855c9f-4a07-4cba-aea4-a9c614763731", "comment": "Malware payload (ZeuS)", "value": "88143cf3022f412fdb570a1cb72d1802ce6b82b27a13874915b7aeb1594178827c5cb2e2b2e1d4c98848e49045b745b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258075, "uuid": "8d321c54-c510-47e6-a54e-39b3297bc073", "value": "T18555231393D24FB9F0765976AC704A46DEFA7E621026886F97E6160F4F3B8708627343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258075, "uuid": "564e7502-af52-482a-abe1-03156946ea3b", "value": "2d07b8a4d02d06c6d33e155dde6c1279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258075, "uuid": "a10897f6-485a-4057-849f-aa6ddfcb3f5f", "value": "24576:Eb3ZNCjdf4hLEwTeUxjugpaZj9hQAK2Z5NcI/7R7jaBil7GCH5ak7/:EbpNCjB4FEUeUxjfoZZii9aBCH5aC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648258075, "uuid": "0d89475c-94f0-449c-abf9-0a796b4db179", "value": 1394688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648258075, "uuid": "c74489a4-cb0d-4256-b4ac-1e00ba7ab3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258075, "uuid": "59251f79-4ab0-43ff-8b4f-c1e5d12f1a96", "value": "aa0762d7122483c149976660ef7fd4ad159e037614e5b3ba7fdf6a26b90b80a7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85746e5d-aca4-11ec-9275-42010a9c0029", "comment": "Malware payload (ZeuS)", "timestamp": 1648258315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258315, "uuid": "eb9a0016-186f-475f-8cfe-b6fc749cf724", "comment": "Malware payload (ZeuS)", "value": "d79e1d1343dd725d38ebf4a57a48bc6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258315, "uuid": "f2ba74db-0466-4bd4-87cc-3db339b62430", "comment": "Malware payload (ZeuS)", "value": "b5eb858ed1498c31460c40a12eb6e989b2cd01c17cac48c5337eca8230bbbcf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258315, "uuid": "909b7ffb-57d9-4cb1-8677-1d4c46409b25", "comment": "Malware payload (ZeuS)", "value": "44eccaf9d5e79cd2aca7febec95ff693b0cb49f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258315, "uuid": "3c60f716-cc54-4432-aeed-468f8437ef07", "comment": "Malware payload (ZeuS)", "value": "82e532228e9a4f040bcf003e418042820c1b3ea050134f49ebc2483fcfb5d4b9927908af39e0cdea6aa9f628b8e4ee99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258315, "uuid": "61b58ad2-f9a7-4f5c-a6d9-1dc4b1a0f86d", "value": "T1FAC423825259DCF3D85494F8A850CDBA8CB4FDA90177B4BEA387C8C66B91F40375E6C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258315, "uuid": "7199e2da-a956-4e2b-880f-0ad18e46c57a", "value": "0c1e0b4890cc87424a0fd0132621e9be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258315, "uuid": "60a8808b-ec64-4fc4-871e-516dc10c351f", "value": "12288:PTyjdUP4Be97a8eu+D9MJHf/ZGi1iahm1lRuk2ZOS45WwX:PTAdMoe9OpuUMJHf/ZGi1N8HR3SjwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648258315, "uuid": "f77e98f1-cc90-47a1-b7d7-803e7eb7dfb0", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648258315, "uuid": "ca0d734b-2914-4a79-8977-8891068c5c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258315, "uuid": "af3eb261-5e38-4edd-be6a-ad651546fce6", "value": "b5eb858ed1498c31460c40a12eb6e989b2cd01c17cac48c5337eca8230bbbcf1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa174c77-ad30-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648318640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648318640, "uuid": "81eeb8fa-c656-4d55-953c-4e0a7bf79948", "comment": "Malware payload", "value": "586c0e7a21ee12bf37adb29e2e5f7a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GruntStager", "colour": "#02C0C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648318640, "uuid": "b6797596-9d3d-4fcf-8bac-d5289d15efab", "comment": "Malware payload", "value": "b78029fdb5c7d721b7fb81ffeb567b85177a35efe3d04491932469974cf0fa53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GruntStager", "colour": "#02C0C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648318640, "uuid": "caf08364-bbc0-4cd9-bc36-91ffc6025967", "comment": "Malware payload", "value": "f5acd0281efe9062d619492e0737293858d2e89c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GruntStager", "colour": "#02C0C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648318640, "uuid": "a31cefad-ba0c-421c-b587-ae3f210e3c7e", "comment": "Malware payload", "value": "7bd86651127fe0b7b4c0334436b697ad0ffb4ea60826520122b8f96ea89b50297f89dce4b5c4e3ace1dc6dba6f9228b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GruntStager", "colour": "#02C0C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648318640, "uuid": "22fa1d26-dcfe-453c-b340-6f19600c4db6", "value": "T1EB322B1D3AD5CAA6D17EDA782CE3416842BBD65B1011EACB1FCB94CE2FB37441811F89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648318640, "uuid": "3f7b798b-a1b2-40d3-ad65-72f308a7bb33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648318640, "uuid": "c7ada1ce-51f3-4070-ac1f-0641d51aa3b8", "value": "192:b6nOwp9ge7lPSxXdAKSRyJX8XaxbXHms2Z0LrfLWiaspNWdLh/4:WnOYC3XzX8Xaxb3h2aaiFWdhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648318640, "uuid": "ae8ca8d8-1ae0-447a-802e-015a7d33edc1", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648318640, "uuid": "44c349be-0124-47a8-a239-86b3f38a1c5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648318640, "uuid": "4e2454c6-061d-4bfe-b57b-4c79c0c1706b", "value": "ntH1DDaZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35500c3-acce-11ec-9275-42010a9c0029", "comment": "Malware payload (Sage)", "timestamp": 1648276538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276538, "uuid": "9c630694-d268-48cd-a646-243a185293bb", "comment": "Malware payload (Sage)", "value": "9ec36b9bd29fcd858d1e2672dd1bdc70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sage", "colour": "#953FF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276538, "uuid": "78769c8c-f99d-439f-aadf-afcce155e7f4", "comment": "Malware payload (Sage)", "value": "b7a8be8de5848a8212159e2d4e79c0d97bed04272aea99abc19c39281f49c835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sage", "colour": "#953FF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276538, "uuid": "3c839c3c-e12b-4e41-9976-53beb5f13a6d", "comment": "Malware payload (Sage)", "value": "8f5a70223c58199239b5197f59dce7560b158f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sage", "colour": "#953FF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276538, "uuid": "75c0ac03-33cc-4fbe-a319-e4fcc61ba3e0", "comment": "Malware payload (Sage)", "value": "b6be449ecc823c06707b70649ed0af9c3f6d8e27159667bbe48b9c96ff78b383b30821fa3773232767980342d8e3e8a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sage", "colour": "#953FF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276538, "uuid": "f8967ac2-be23-4f1f-aad7-c461b9ec1bcf", "value": "T1F274CF12B6E0C431D4F249710975C6A15A7DFE304EF46AEB53B8363E2E752D06632BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276538, "uuid": "f252dc65-af12-40b8-b65c-37ce82c28c56", "value": "00d679ebdf6e5a1162882b53660d628e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276538, "uuid": "a15f2aa9-819a-4280-a732-073d8c9feaa6", "value": "6144:/nYGYzfdtj1alRL2ERw4UAJrx2A41E7vc7YI6Na2U:/nYGYj/j428rx2ApvcUPbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276538, "uuid": "d2decd54-dc8c-4259-972c-075adff2aa18", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276538, "uuid": "cb69303e-036b-4659-b415-bdfd2c42b484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276538, "uuid": "defcfd9a-e6e7-41cb-a14b-0d3356934ed0", "value": "sage1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4279e88d-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648277101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277101, "uuid": "50c01320-3803-4df6-b921-b4a6abc571f9", "comment": "Malware payload", "value": "5183ce2cdd2d35326f5aa5edd7840001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277101, "uuid": "8035a888-c378-4572-8e0a-f61d2fbb32e7", "comment": "Malware payload", "value": "b8d9b178e9293ebb488940dd95e217fecb98ea38146f0253b8922274e51996f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277101, "uuid": "37e0bc3d-4ea4-4aee-b6c1-e25751315a48", "comment": "Malware payload", "value": "9cf496ffc825a513b6e69879c8008f5ffe5b6ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277101, "uuid": "a8dafc9c-2f2d-4d65-9b8b-4c05c15913ec", "comment": "Malware payload", "value": "228fe6a33b2802012ca293a21ccd3c3cefa8fe5f501930431f5757be94d71c026a8c73dcedb43c49c10c366691d3a817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277101, "uuid": "4e0451f6-e69d-4bcf-9658-398ce958a27a", "value": "T1650601FA610C3794C41788389423FD5A72B6521F0BE699AE7DCF37807B9E444EA46F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277101, "uuid": "46dba217-a1c4-4935-8d95-48bd6859f059", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277101, "uuid": "59d56eb4-bc1b-44ce-8a76-0d4b286a17e8", "value": "98304:2IQWh6zcRzKDn3U9vkPEp4Vk2w/uCD4WKLDp7oA:2IQDhnk9sPtk2w/uCAFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277101, "uuid": "126ac4ad-db46-4ad7-8a6f-a46e60eb0d4b", "value": 3968512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277101, "uuid": "de9c7d05-6089-4438-b2d0-9bd6529c9f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277101, "uuid": "f57eec4e-70cf-4203-a4cd-21d2265a012f", "value": "5183ce2cdd2d35326f5aa5edd7840001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a39bb2-ad46-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648327867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648327867, "uuid": "a037d891-95c8-43e6-b086-106278855179", "comment": "Malware payload (RedLineStealer)", "value": "57f2b5ce4666fa2b27a3634682debe17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648327867, "uuid": "c574a753-ebac-4a4e-9999-144c1a2b0859", "comment": "Malware payload (RedLineStealer)", "value": "bd0b152a5a8a90ac500a7afb219a27a859cbbb9bf3517996cd5cd33e989910c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648327867, "uuid": "e37fae05-c347-4025-ac05-ad8505729adf", "comment": "Malware payload (RedLineStealer)", "value": "4bad4f831271e2c5084651d6788f2c94bd3079e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648327867, "uuid": "1b70d686-8d24-4d8f-bae7-a05c9c8b3984", "comment": "Malware payload (RedLineStealer)", "value": "cc0fe03356082758aed986d16670d4515e5d84f48019a8105e5f29615e089841a8861d30980e09b3ca34f721e40987f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648327867, "uuid": "5ed32276-928e-4667-a453-b6a0a09ec0a0", "value": "T1E4C42321A92BF5E0E44B6AB58B62C5B9E240EC36DB8FA30F1C7CBD043C35441E475E89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648327867, "uuid": "b4888b32-a5a0-4d13-9a0c-ca218fe1ee82", "value": "bbef650a1476a71384fe3e96a4abd566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648327867, "uuid": "e0fffecb-9c89-4b86-b5ea-77a7e48dcc55", "value": "12288:LhXPUU7VJAhqK0bysV9OUL1UR2Ro5iGobYYHiE:LhXMcVcqK+R9OULRoYGobYYHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648327867, "uuid": "63499b3b-3b68-4171-9548-cc0f65442f0e", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648327867, "uuid": "cd2e31fc-e3bd-4566-a9cc-2c76c2681de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648327867, "uuid": "95074c2b-d6bd-441c-b95a-82d1498d75a2", "value": "57f2b5ce4666fa2b27a3634682debe17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83407d2c-accf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648276780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276780, "uuid": "d08c3629-abf6-4082-ae80-a12c5123c85b", "comment": "Malware payload (RedLineStealer)", "value": "34be4515707314d15084bcc30869d50a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276780, "uuid": "b6e47c8a-e2fb-463c-bb02-a77bde91c4c1", "comment": "Malware payload (RedLineStealer)", "value": "bfc74cb119f38986f6b4a00e3a342363221201b0375ea9331edd63c8ac1470d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276780, "uuid": "e9b01eb7-9bc9-49c7-af17-107112c6386d", "comment": "Malware payload (RedLineStealer)", "value": "8221561a56955789a253347194d6b391679d1e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276780, "uuid": "a457ecea-a401-43f9-a68b-bd127ae60d5e", "comment": "Malware payload (RedLineStealer)", "value": "a2dce779f0dac92bbdb350ab1436bc11b8cf649251001095404770e7ec67f8612df14c9060399fb0945b2ca5dcdc38ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276780, "uuid": "e11e58b9-4b80-46e7-b8f0-8069add4bcfb", "value": "T16DD423E772A1752EC24A8BB49E56DB9B814BD114A0D2F603F3A744E2704F0369F3798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276780, "uuid": "d52e1753-38a2-4160-9cc0-978ad5f014d6", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276780, "uuid": "2d8fa904-c402-4efe-8108-1ddc3668cf1e", "value": "12288:ZqFqKIzomD3Dp2h1vYSQS03ULaHNqrxlKIQNoeiKhDW1gxVGh:ZqJ+EkSkEaHNYK34YagHGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276780, "uuid": "f57f2d29-c15b-47fb-9570-4e8ab9af3f57", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276780, "uuid": "924dd12f-766b-4b68-8fc9-56eec421e0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276780, "uuid": "79c07d97-4f93-46e0-b6b6-1b80ee17b698", "value": "ANTIBAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e09cd4f-ad1d-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1648310084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310084, "uuid": "23d2783f-42af-4744-b085-dd3aac58a267", "comment": "Malware payload (Vjw0rm)", "value": "f158edaa4f393576c18586889c2ab62b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310084, "uuid": "a91c90e1-a2d3-4285-8e9f-7df6be732df0", "comment": "Malware payload (Vjw0rm)", "value": "c2a62e3a170efa1a16b18c7c173c4ddda4f5e13e0f6856d1f4226b297cd27c6f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310084, "uuid": "75daf685-2c3e-424b-84c2-49656d803ef5", "comment": "Malware payload (Vjw0rm)", "value": "3badef58318a1d1b57560652f26b7afa3581a9ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310084, "uuid": "1ba93a2c-5223-4d9c-8612-42afddae896d", "comment": "Malware payload (Vjw0rm)", "value": "e51496e5b23821c6323b3791a7b507906b2f4df69be1b9dfdfc6ead453e5078e0fbbf676425601d87d9a9b6b8e8f2543", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310084, "uuid": "52f4e1b6-49df-4b90-825c-cb9d82c060f4", "value": "T1C53228E8AC517E0ACA14E151673B5DD8AFF9130B85948A8E383CB5059771A40DBBEF3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310084, "uuid": "eb46d118-9fd3-4d6e-b49b-2abbdbdfd8df", "value": "192:S3f6J229dBfbv3NjgMQwyIIKaxRUrYSMW9GDiDW5dU3oNmHWEDnzg2pgcWSojZEz:SgdROIk4UxrJmx0XcWSou5yAhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310084, "uuid": "0d928478-ea35-4daf-8df4-dbdbf970e6b7", "value": 11193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310084, "uuid": "6af83777-585a-48cd-9451-d6c0eac3faf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310084, "uuid": "6c07550c-e1cd-4d8e-93dc-eb49c584bbfc", "value": "eVoucher#008891.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23740c2-ad33-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648319862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319862, "uuid": "72cf7cdc-0677-4cfd-988a-69c6e3d3dd7a", "comment": "Malware payload", "value": "5de98325aadd8ffd68ee1a8eda2eeb37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319862, "uuid": "c68730c4-b6a8-4bab-865f-f006f13395a1", "comment": "Malware payload", "value": "c3b3dde6d1f35dada7763ce6809637b3ebf018d812370268183fc50bd42d0c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319862, "uuid": "e1baf4ad-dc42-4856-a94f-21c177abbe61", "comment": "Malware payload", "value": "03ae54da656b0eb4232f7592f8d817fc91086c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319862, "uuid": "f9c8a8ea-8fd4-42b5-b46d-442cae080fd2", "comment": "Malware payload", "value": "d446560b25f05007917ad8f6c01c421d14eed728fb71daf84c1d5caf32edd7fa2eb21f6d5d3fa0d947c1eebf3315e460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319862, "uuid": "5119564f-edfd-4ed3-ae0a-040f76bac45a", "value": "T116247C036B443E73CB67093B0CB74636D4B2D3408328C9C3AFA468696B567E17E7A349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319862, "uuid": "b5a12582-a3a6-472e-906e-26edbfc45831", "value": "d028ed91d908ca3f4bdbbbb8a346d246", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319862, "uuid": "be32218d-fcd0-45ee-9532-2b6ee41af469", "value": "768:ODw1RFtrJ9Qhtn2U75RDw1RUTPE6h3O2TDw1RFtrJ9Qhtn2L75RDw1RUTPE6h3O2:Ootri2wpb7pOwotri2jpb7pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648319862, "uuid": "4c2b3d60-af25-4232-818e-d5786a5c2d8b", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648319862, "uuid": "1785abe5-5870-4817-99f4-f7fa5fd2aaf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319862, "uuid": "6039e5d6-0c4a-4d90-8de4-3d77a38f1840", "value": "generic4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8314f8-accc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648275668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648275668, "uuid": "af9fd7fc-f010-40b3-8d61-f94173fcce31", "comment": "Malware payload", "value": "cacf323c63448c0aac36cb2dae92d8f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648275668, "uuid": "7b0dbee7-e6a4-4140-b63f-3282c810db10", "comment": "Malware payload", "value": "c4bf22c74971989ccf98aafcb3293325e06bf37402eb51930ca5429ae0bbf01c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648275668, "uuid": "58c53872-acb3-4c9c-92eb-2f09214210f5", "comment": "Malware payload", "value": "6a0405fc3c315ad7e0458da870b9b715925df4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648275668, "uuid": "984fb34c-3af7-4765-afe7-746a98081ee3", "comment": "Malware payload", "value": "5af76f46745b13a14bd618fdaa70c02c11ab9f86e18dc8129db38b164dbcc9318387ddacdd1f8857de3d6b806d40b387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648275668, "uuid": "410c81db-bca5-4ca7-a4f3-d310fff35c5e", "value": "T1F87321DD766072DFC857D472DEA81CA8FA60747B931B8203A42716EDAA4D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648275668, "uuid": "600ac895-027a-4f38-aa08-f3b45929adc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648275668, "uuid": "260bde09-0636-445e-9dc3-08b0da7fef8c", "value": "1536:8y0vsunlNdQieEkZqSgguu2psmBpLm80+kzYhe:8ymBVzeEkZtuuTmBpLm80+kzYhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648275668, "uuid": "3fa6ea64-1c61-49a8-8d58-be9fee5fbd03", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648275668, "uuid": "1d3528d2-4183-4af3-9a70-4741c62c1c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648275668, "uuid": "1afb75fe-067e-4d91-8b59-9e7fb92e840d", "value": "baimless.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a761a2a5-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648310771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310771, "uuid": "4b8fb954-8a9c-40be-b15b-016c57f2afe9", "comment": "Malware payload (Smoke Loader)", "value": "01dc1291930326e3b9aa3672ae7efe84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310771, "uuid": "905a4e11-04c6-4727-bce2-855680c7ebf0", "comment": "Malware payload (Smoke Loader)", "value": "c5665332e8ca3d76fb4b583b3ff97d1f99828f33cad445b22020147bf9079f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310771, "uuid": "2bb21ac1-d552-41d9-874e-ff10f97ff495", "comment": "Malware payload (Smoke Loader)", "value": "eb9108f4ffd1ec854e0681ce8365bf69f4e3105e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310771, "uuid": "8ae226b1-d812-4b3e-8fe4-375940b57a57", "comment": "Malware payload (Smoke Loader)", "value": "e0bac9c1ebd2aa384dfedde75a9f26bc24f7a6c5b26e5698cea7c6648c36c893e7f99651ac1306f1c68779cba48c6346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310771, "uuid": "9f850ff3-239d-4449-b152-f5aa90f3a21d", "value": "T17824D0123693D031C4471636B479CBB45EBEAB3257A3094B7BA907BD2F306D156BA30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310771, "uuid": "6205e6f9-3e24-4b1b-8f72-ae29d56e2abb", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310771, "uuid": "6c251442-3795-41b6-a1d1-48fcabb51019", "value": "1536:bdKpi5tbTqAdAGkDf+HrN0OjisNkafiw4CpYKxgTr45lGZDvGzM:bdKpiAIjisWdCeKxgY5lGZzGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310771, "uuid": "721e5af5-4e55-4a59-b11d-7aaaeba61c76", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310771, "uuid": "cab3fa5b-faa4-4a87-8765-9c79960bde66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310771, "uuid": "5ab7a1f9-3d38-4d76-998c-7be677f0f9e5", "value": "01dc1291930326e3b9aa3672ae7efe84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273ff20e-acd6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1648279632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279632, "uuid": "44ffe956-38ee-4548-bae1-8326a3de2d8c", "comment": "Malware payload (Loki)", "value": "ca2463e6f591f3e77106b8d232e9af84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279632, "uuid": "f2830f9f-ed67-4c34-a066-611f76495efe", "comment": "Malware payload (Loki)", "value": "c57b86be5a9fa166a946d78d8b63d9817ff3e14df83abd88b654bd66167696de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279632, "uuid": "415948d6-819d-4225-9d63-5c6754393bf1", "comment": "Malware payload (Loki)", "value": "d5318fd31d6ff0aedeb19f4d99b15e26985ecbab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279632, "uuid": "9c5d4baa-c27d-4f92-8f0a-4efd3af7db94", "comment": "Malware payload (Loki)", "value": "9e9a903966a5cccbb94f90115da84fa145a65c8e3c5de3af22ca2c7290ea6fbce3b1330a33add2d6753efad27a97db79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279632, "uuid": "02d42bab-b081-4570-be94-2dd025dac1fa", "value": "T155449D00BB90D035F5B752F44C7A93ACB53E7AA15B21A0CB23E52AEE56356E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279632, "uuid": "57fa4d44-1016-4717-9648-55d22e78e357", "value": "e22fde80595c4bea0880fd6845018d6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279632, "uuid": "43ae5d4d-58d9-4cf2-9d71-428e647e5e70", "value": "6144:9917J2Wor8Z4gPjdq5Q1a5Q75ybFvjyTLtno:9HTor8Z4gJGQp75qRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648279632, "uuid": "1fe80ebc-55b4-4f97-bccf-5f3de0490637", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648279632, "uuid": "9ca58617-b5f9-42a3-806b-5a817ad6ffe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279632, "uuid": "7239c4ef-079b-4971-9ed4-43da60e51790", "value": "ca2463e6f591f3e77106b8d232e9af84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177c3736-acd6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1648279605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279605, "uuid": "0c8440a3-9696-406a-9ac3-929768927bd1", "comment": "Malware payload (Loki)", "value": "d1f43ac76f92fdf3238b77b69f535570", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279605, "uuid": "0d92e05a-82e4-4cb7-88c1-14a41abf08ba", "comment": "Malware payload (Loki)", "value": "c5fb4d13bb4b34f9670bc238a047b53c4392b299139c3da8b2b70ba9ddd3db2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279605, "uuid": "7b3f4123-6457-4092-ad8a-c498da8917bc", "comment": "Malware payload (Loki)", "value": "8b46349643c840159ee689f43fddc0234223c672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279605, "uuid": "6765e4c0-47fd-4b4e-86df-fd9f1984e7aa", "comment": "Malware payload (Loki)", "value": "8d030ff0149c33aed268428f7417f93d4e113a49ce04aae9e5e8a5dbcea5031f8037ef07777f75d37d22a19ea6c45ea3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279605, "uuid": "2d6dd5fc-4012-44f1-a786-3521b4b0f210", "value": "T12244AD00B7A0D035E1B712F4887A93AC753E7AA15B3590CB62D52BEE66357E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279605, "uuid": "299d22a4-edc8-4f50-af54-f4ea4b4d4692", "value": "e22fde80595c4bea0880fd6845018d6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279605, "uuid": "c0f6f2b9-13d8-4300-a151-928376350b9e", "value": "3072:e072IS3LradTKvOypCmyGJOB9P4+5F0Ogp/fqzVkB9a5nLum2/ZWbjM+dlNR6tA/:QaRY/0jWt+MOgpfqCBKL4B6p+tA8Jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648279605, "uuid": "99cd0ff0-9ce4-49dc-804b-6ebcd91f2bb5", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648279605, "uuid": "fc3bcb0e-8791-4588-a1af-c124815ed8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279605, "uuid": "cb637d8e-7fe2-44b8-a740-c47fcf01a108", "value": "d1f43ac76f92fdf3238b77b69f535570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3faf9b-aca4-11ec-9275-42010a9c0029", "comment": "Malware payload (ZeuS)", "timestamp": 1648258162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258162, "uuid": "59ee7ccf-cf76-4c73-8c7b-e363a321ef04", "comment": "Malware payload (ZeuS)", "value": "62dd270c7a45183db0a73060993e2583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258162, "uuid": "06033ad8-45ed-492e-8cec-e98a83bb92d4", "comment": "Malware payload (ZeuS)", "value": "c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258162, "uuid": "d2b12b9d-08dd-4e2b-97b9-3970beb2bb1a", "comment": "Malware payload (ZeuS)", "value": "637555c1d202f54aa2e3bf192217eda00046e0dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258162, "uuid": "bc09a1fc-6c2d-4ee9-b99c-062d1103d8d2", "comment": "Malware payload (ZeuS)", "value": "28e882c60ce690f8b9984db48c4ef186361775d227e57fe50412ecd568ba3fc3d673c63f20bbfe4f3c770a4a8f76fb0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258162, "uuid": "1fa1f21d-ff3e-4999-805a-4073fe2a44b6", "value": "T136C4128533F94629E5BA5F731CB4281409F7FE161D78C4CE9A94808F8B30AB59B76B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258162, "uuid": "b0681037-3798-4ef0-8764-20c4495ed689", "value": "7252ceab41cd55ec19d8fd3d84378d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258162, "uuid": "5aa4bc8f-3fad-4742-8ade-e48e0699fa5f", "value": "12288:Jz/rTEVMSUYYRTNEznofMVdmG6QvQztBvE84BI:JDS+RTxEVdmrQIB884y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648258162, "uuid": "d750fdd9-b45c-441e-9e88-2d135eb96b14", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648258162, "uuid": "37997356-32b1-498f-9428-b1d8c7161c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258162, "uuid": "4b16f093-02ef-4fa8-ae7c-5dea097b3af6", "value": "c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e832d3c7-ad53-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648333643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648333643, "uuid": "30696451-1f3c-4e93-b939-8c4e7d6b6812", "comment": "Malware payload", "value": "f9e4785fbb7c441722f89b6a7b17336d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648333643, "uuid": "0a2e7b4f-e716-415f-ad60-c3f9cbdc224b", "comment": "Malware payload", "value": "c72aa9c4df96e6768a8a1db299a8e787ac729faa40c536fa4344f82d4670a947", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648333643, "uuid": "37f6e16d-be45-4394-aa6a-b8bd43e3029f", "comment": "Malware payload", "value": "61d1345c46929ee0252eb3f0672ddecd556627b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648333643, "uuid": "b6eaa61c-5f68-409b-9078-1818ff88a3b3", "comment": "Malware payload", "value": "96d714070895dba62f607cff2e59acb9e40fbfbc35fd027e1f16acbb5bf0ea59586a177db1ae4fe116ba39d723d4512e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648333643, "uuid": "f9faa078-f53c-4867-bb62-e50bcaa35dbb", "value": "T10535230334D3C573C08AB136B866C3166BAA24615863694F57F6077A7F302F1F6AA71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648333643, "uuid": "25936557-7967-474c-82e3-97590c22b7cd", "value": "a945bbba5e19a9f29aa1458bdc91ed8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648333643, "uuid": "9e2ae594-d84f-4fd5-a059-1191f718c5ec", "value": "24576:wfsR8o3JTx4kuyQnYmEopLYf/TZRIG5tbO3HQyTB/kAZYwF8:wc8o312kuyQnYmEIeRIG5t0HQk+Aq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648333643, "uuid": "b2bd4e5c-2cc3-49fb-bd5e-255744b79b9f", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648333643, "uuid": "eee0fdfe-bb90-4b79-993c-b79890f4e416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648333643, "uuid": "0b9b84bc-e039-4bd0-9802-0c2b70a72495", "value": "f9e4785fbb7c441722f89b6a7b17336d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42a4707-ad1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648311275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311275, "uuid": "c754b923-2d89-4437-9109-44dad8e0c9d7", "comment": "Malware payload (Smoke Loader)", "value": "ea55ebe2ac68258155e9c04abffa46a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311275, "uuid": "1a84ba8f-1843-4011-b400-36b5b3c6103b", "comment": "Malware payload (Smoke Loader)", "value": "c7f05a51ef9cd4372057583af5ddef7ea41d377ecbdb06aa604de8b59f277bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311275, "uuid": "ee43f857-255d-441c-b386-9a13a4436d55", "comment": "Malware payload (Smoke Loader)", "value": "0c79102f4a043097c72162aa4474f17e51cb406a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648311275, "uuid": "ea21d3e2-83d6-46de-9123-69769cb33984", "comment": "Malware payload (Smoke Loader)", "value": "0983c6a284d32ecad23bcbe6b856f5d845abfb57c6274689f775ec44311908b6ae58b582a4d6b53420b342a3fddf701f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311275, "uuid": "d19e5616-4196-440e-b996-ca651114677a", "value": "T1D2449E00BBA0D035E1B712F4497AC3ADB92E7AB15B2561CB72D51BEE16356E4EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311275, "uuid": "6f9a8119-9464-4249-b7fa-e347a413d885", "value": "3944abc45db6fde5aef61e579409b3ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311275, "uuid": "11cb8b56-c911-481f-a5fc-79403fa905f1", "value": "6144:dqu56vuDheY0/giQp4FgWD3QzwQmIkTEkZ27o:d6vuFb0/gu+WDgsvLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648311275, "uuid": "550980d7-e2ca-4456-b6c9-232d382480e2", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648311275, "uuid": "8b34088b-9877-4e44-b9dc-106f97ad2c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648311275, "uuid": "2970c519-b638-4e3a-8dcf-64e508a554e7", "value": "ea55ebe2ac68258155e9c04abffa46a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15784d9-aceb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648288856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648288856, "uuid": "c71e4956-2db7-4a7b-bc4d-8c46c21e1742", "comment": "Malware payload (RedLineStealer)", "value": "dbc840d3ed367973634739dd964d7ac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648288856, "uuid": "8c0e4874-2c5c-4835-937f-c31afca8693f", "comment": "Malware payload (RedLineStealer)", "value": "c80f5360d6e3484ff09bd86186baffa361803879e40ceaa9af984cdf68ffea5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648288856, "uuid": "d64bd1a7-19e9-4dcd-9e92-e5481eba82e8", "comment": "Malware payload (RedLineStealer)", "value": "b7e2144aeffeab9570dfa72a594ab9682378ff01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648288856, "uuid": "979842a9-5220-405b-8b65-4669b6543717", "comment": "Malware payload (RedLineStealer)", "value": "de9072c3af4138e58406fe0b4542a0bba8a29d42acffae32da8e65204135ff4590309f6d72c2bc3208e6dd40f4a846f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648288856, "uuid": "cc628340-4d2f-4a0a-9bd2-47b257a77406", "value": "T1D324BF117681D032C4970535B474DB696E7AF43113A1058BBBA90AFE1FF03E296F67CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648288856, "uuid": "d77ad086-4a7b-471e-8ca7-0907bc29b1a5", "value": "2bdd43acf181bf5b35cc83a05996f85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648288856, "uuid": "830cf9c0-fb6b-4d8d-81a5-5ec32c2a89cb", "value": "1536:4bKK0uq9D8rs0DKc1rSoOEnASD/+CFKmWS5NOBSGy65Nlsa6wazX:4bKK0udcEAuWCFKmWi6SGF5HsFbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648288856, "uuid": "0e38b315-1259-4054-8248-1557d394f0ba", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648288856, "uuid": "9368ca4b-812d-4992-8c89-71598e73d6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648288856, "uuid": "2f666ec9-d2b3-4ebb-bd5e-f21dcc39556f", "value": "dbc840d3ed367973634739dd964d7ac0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d006ae56-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648277338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277338, "uuid": "379b7761-67e1-4325-9eba-92e33f64092f", "comment": "Malware payload", "value": "88ea84a1019d310b9e6b12377bee5a54", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277338, "uuid": "63edfb7e-fedc-4191-9175-e23245d196fe", "comment": "Malware payload", "value": "ca24e3397538eee970d55f57609c5df47b39b342f421de32501c1530699a0720", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277338, "uuid": "351e16a9-0d3e-4642-92b0-99eed88c8986", "comment": "Malware payload", "value": "77bed166ad197a7e78600137baf06500f1252360", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277338, "uuid": "6cd9cf57-f0d3-456c-8e0b-8d341599b862", "comment": "Malware payload", "value": "389eb85a1fd3a4a2cfc578be76fe49e7b996ef908ce9626b8fa89454c8557b4558529dff686b09e73a2f62635c78b153", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277338, "uuid": "4239ec26-6e80-4474-91be-22c80cc149f9", "value": "T14B14125EB6C4194EC9A3AA39C2643A15CA33DCC845574ACF9BB8F25E373AB045F01379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277338, "uuid": "fe18e59b-1a08-427e-9646-c53927f7297a", "value": "3072:TZiToVXHjX8bnfl9DNOPXG0pZjGVJsmB/rmWlj0rGJtpyFamaGlOKBJakM5EwW96:8YXjMrp437jGImBCQxpJmZOKBtGEwWLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277338, "uuid": "1e46ec64-b93e-4c97-b268-3846918583af", "value": 192104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277338, "uuid": "49d4662c-47ba-4fc7-9233-5308632a21e8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277338, "uuid": "bec06c21-ebbe-468c-8a28-6f75ef0b1bf4", "value": "prop.759377.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aaf7c0e-acd3-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1648278295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648278295, "uuid": "c9bde455-7068-4c47-be01-be6bf953ddbe", "comment": "Malware payload (DCRat)", "value": "1f99ae08d19987c5ae8c93375e27de5b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648278295, "uuid": "3455e084-10f0-49d6-837b-d5e6f93b825e", "comment": "Malware payload (DCRat)", "value": "cd244c0cd81089d3e67202e3da008f4b71d16413769b29e8210ad1bb6a81065d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648278295, "uuid": "3b270780-7d9e-4c73-a438-d372b6eee31b", "comment": "Malware payload (DCRat)", "value": "6dd5896c1ec5b0ace9aa481901fc3f15e98165db", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648278295, "uuid": "ee684fea-6bb5-4240-ae0d-0f729ab330c7", "comment": "Malware payload (DCRat)", "value": "849061ab9e9222dfe173f7270d2d3ba69e194771ba92f6d199a8d40cb35efd8842a79247c482e895f0b66a5de4b85580", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648278295, "uuid": "4974d782-fb17-435c-a26b-4920444a16bd", "value": "T1B2F496342EEA5029F177AF7D8AE03596DA6EB6A33707964D04B102C60723B42DDD163F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648278295, "uuid": "07c0285d-d00a-4810-b81b-9fed960406d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648278295, "uuid": "7a56125b-b233-4cca-92e9-d033e9d3ea92", "value": "12288:/kPzzbV2YIk6/nsEwrMxsmk48U9W3Gp9zbveFZiUaCFzE4tk:/wp2Y16/FKSPjMFV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648278295, "uuid": "0c634830-2052-4d53-8ea1-14451ae988e0", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648278295, "uuid": "e76801ba-af9e-467f-a5f8-2245045283f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648278295, "uuid": "0bc61159-2108-4b58-a6d2-395ab2174209", "value": "fontsessionSavesRef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5513942-aca0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648256704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648256704, "uuid": "f807c842-73c0-46e2-a970-deb50d9a70fc", "comment": "Malware payload (Heodo)", "value": "8e66c890cc5ead9727dfd97a9c976756", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648256704, "uuid": "4226e1e2-6870-40c9-b632-a4ab9c592020", "comment": "Malware payload (Heodo)", "value": "ceee70565c0a9bbd680b4b7ed03b6be4185cf8baa36bcd956e2cbcfd7ad00a94", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648256704, "uuid": "fb7a5efc-7b8e-4bfe-b338-06f4a5b9b23f", "comment": "Malware payload (Heodo)", "value": "b6a24aa669de33937a2265ff39c0ba326b3560f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648256704, "uuid": "2bcb8da9-81be-4c8b-8c9a-ddd46d8c6bc7", "comment": "Malware payload (Heodo)", "value": "ee0a126efe87ac3da3466b06bbe43c66ac6d3b74967b221bdc663299740fb69283f6cde92e1be3c9cf306802e452471e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648256704, "uuid": "af09da78-6dfb-4891-a10a-47f655ece864", "value": "T143E45B61B49340B7C3DE913025D9E2600699AFFACB7F88F73B84543DB6A09538B7CA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648256704, "uuid": "fad705cd-5dd8-4ca7-9cb1-0910ad4bccbe", "value": "830353e93f5c80d691f8ce13b3aa74da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648256704, "uuid": "9587b7fc-1ee6-4599-ad59-c678de5cca21", "value": "6144:F/aZgRXcZdinj5y1baFLk5Dw2jb7t3mJXzQ3aCIXilmj2cO8h35jnL/nvYwFaRVb:BamncoLAbcdCxmSc/Jf/ngwFGMD0sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648256704, "uuid": "e34db9b3-0d4a-4eea-bd1f-5e9418efbf07", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648256704, "uuid": "ab2bc866-4af0-40e0-9aed-72414062923a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648256704, "uuid": "2d4efa25-38cd-42cf-9d78-6aee7b720886", "value": "emotet_exe_e5_ceee70565c0a9bbd680b4b7ed03b6be4185cf8baa36bcd956e2cbcfd7ad00a94_2022-03-26__010459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5db89fc-ac9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648255068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255068, "uuid": "50fd100b-e84a-482c-9dc1-c421560cfc79", "comment": "Malware payload (Heodo)", "value": "b61e348ffed0c8bb4c2c01d7b4b124a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255068, "uuid": "6854b5af-1458-4c0e-ae7f-4eda3c84d1ad", "comment": "Malware payload (Heodo)", "value": "cfcf44372615eb3d9220a13bd460b90db7df7142de49545a4595b73dc0dca3e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255068, "uuid": "2f60d6c4-37b2-49d8-b890-1c95b8203b89", "comment": "Malware payload (Heodo)", "value": "3ede3e778ce129c98fe2b86a64bb649552c42f33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648255068, "uuid": "4373bc3a-4555-4ce9-bb47-a18769a52570", "comment": "Malware payload (Heodo)", "value": "7bff0b3da9936546b4511dd838c275aca1310673947b5ecbd9c838a29a7c633b1c54522a3b3c361dd53caca85d23beb2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255068, "uuid": "2f50bff5-7249-4378-8171-0340952dee4f", "value": "T1BE34920233C361F0CA53B564840FD425BCA7B43C7B15497DA14BA5AF87EB8D09A34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255068, "uuid": "e03ce840-961d-4b1b-b5fd-ee12406ee77f", "value": "3072:4TdrXJjOjQyNo6BUv1gr8qcKRXyMjO8rSXVKfp8GSaztT2GTz:S5uok8qcKhyMlSXVKfKGS4Tp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648255068, "uuid": "87734733-26d2-4a06-b50f-18e00652ca85", "value": 231128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648255068, "uuid": "da094a7a-b74e-419c-8a9e-0d273f92e6f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648255068, "uuid": "1b615045-23a6-4eed-904b-dda5c771f814", "value": "emotet_exe_e5_cfcf44372615eb3d9220a13bd460b90db7df7142de49545a4595b73dc0dca3e7_2022-03-26__003743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b759b7af-acd1-11ec-9275-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1648277726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277726, "uuid": "1b25afec-3dd3-4b93-aafc-0931066edbc9", "comment": "Malware payload (HawkEye)", "value": "ed666bf7f4a0766fcec0e9c8074b089b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277726, "uuid": "5196732a-c043-4a29-b120-cbf62d145ab1", "comment": "Malware payload (HawkEye)", "value": "d1330d349bfbd3aea545fa08ef63339e82a3f4d04e27216ecc4c45304f079264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277726, "uuid": "f8c3982d-6a02-4b06-ac5d-cf49e3c78c89", "comment": "Malware payload (HawkEye)", "value": "1b90f1a4cb6059d573fff115b3598604825d76e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277726, "uuid": "6c729872-8100-43be-8293-b2436a4c39a9", "comment": "Malware payload (HawkEye)", "value": "f619d4c6bfd042d7fbb56d21fc0067269c2ce2ba0bd5c64b3d2c9861c1d78891ee730fc026aea3d33dce10a589d1d14e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277726, "uuid": "a6a0b7ad-f20e-40c6-bdc1-6ebd1975b548", "value": "T1FF15D003B3E04476D4FF01315B7757729BBABD301636C91B87E8188D6EB6291AA36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277726, "uuid": "07d456d7-7d5e-43cc-9161-7c9887c8b7d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277726, "uuid": "d3853fa7-34e3-406f-9608-7f3adfe35d8d", "value": "12288:ypEQtqB5urTIoYWBQk1E+VF9mOx9wi1T0hnbkOWAvyPx4+c/bUUCy:HQtqBorTlYWBhE+V3mO5vWgxE/nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277726, "uuid": "d7b62a0d-7b34-4fdf-b470-b64668e2e8ce", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277726, "uuid": "3f6ffeab-9b73-45c4-b3a8-71965842a8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277726, "uuid": "adfc14df-d38c-4d61-a8c0-954cdd00cae7", "value": "7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f19c094-acd7-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1648280101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648280101, "uuid": "7914f8ce-57bc-4099-9f3b-f37fdc70c0ca", "comment": "Malware payload (CoinMiner)", "value": "6416f7a4a081fc2e094c5a28e3f75dc2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648280101, "uuid": "9c4a39dc-3575-4a0e-8d71-ca2c9202b8e9", "comment": "Malware payload (CoinMiner)", "value": "d191c47ecf5f17775886a155d9bfbe78f0f2511084300bec3696f4dd2108a14b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648280101, "uuid": "313b5118-29fe-4fd4-854a-24eedb82993a", "comment": "Malware payload (CoinMiner)", "value": "c51ab2169015b303821389a8250a1e5ae638af72", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648280101, "uuid": "bba1cc59-2c2c-441e-8503-b4fb39b73960", "comment": "Malware payload (CoinMiner)", "value": "77bd634bfad63d4d3d4afa402227ca5daf5ff3df1f97a7f4bf0f9762e20f81f87990b1ea004e8778a3e36233fbf9f660", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648280101, "uuid": "b4622819-0ae0-4a88-a16a-86a8c2eec730", "value": "T1B77633114D46AAF4CBED09FBAE00EBE3C6E60F4071490F6A2DD7675C58D894BC8221F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648280101, "uuid": "2dc4cc7a-d87c-42c2-9271-aa0b0c1f70d9", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648280101, "uuid": "84c70374-f873-42b6-9f0f-2628c5278694", "value": "98304:C8m01wQ+7S0dFBsrRJt64+qJAKUQJ4m7k/VSXm:Cb01Q69J84jKKUQF7k/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648280101, "uuid": "d9ab8c1d-a6a4-4168-806f-e86445e17317", "value": 7272960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648280101, "uuid": "41f6d6f3-204d-4ffe-84d0-4620e8f90528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648280101, "uuid": "b500118c-d46e-4b74-8693-ab28909fe8bc", "value": "New Fortnite Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab78955d-ad5a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648336547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336547, "uuid": "c4a07c23-d5ed-4f44-8df0-cc476de067a1", "comment": "Malware payload", "value": "e40e748a063686a13f3df81182453bbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336547, "uuid": "604f6a79-8674-494c-8075-7735fbe310c8", "comment": "Malware payload", "value": "d3692d3823bd5e165d88e97bb2c2673489ff76fb873bb28543a2f233c9fe4ff9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336547, "uuid": "36cfb8fe-846a-4430-96f6-84aa3c9950a9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648336547, "uuid": "b8883a7f-ce4f-4252-b2e5-2a200071fc3d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648336547, "uuid": "c39eaa2f-e984-439a-8e42-f267ae866e93", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648336547, "uuid": "8b7d3659-a53e-457a-adf2-e8299bbacbcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648336547, "uuid": "02ef4ac9-3ed4-42ac-a9d2-ac7d7ccfe8f6", "value": "e40e748a063686a13f3df81182453bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c01718-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648277140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277140, "uuid": "f3a236c0-4bf4-4ba6-93c7-a612e9dee696", "comment": "Malware payload (SnakeKeylogger)", "value": "394981494c799a53a1fb370bbed8fc34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277140, "uuid": "4933dbfb-1d66-4320-a333-1317bfb569ca", "comment": "Malware payload (SnakeKeylogger)", "value": "d60f54173982ae505eef800a2bf6ef5e6ca537590b81e2392d9af2bc53db60c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277140, "uuid": "d3eeb8e7-22f4-4db5-ac9e-6301a83cbb65", "comment": "Malware payload (SnakeKeylogger)", "value": "bcac826e7def2223a07e8a8c28db3933cacb5baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277140, "uuid": "5e49c5aa-a12d-4c1e-b9dc-0c7a7213cece", "comment": "Malware payload (SnakeKeylogger)", "value": "30e5cfcb22eecff2eb87db99e14b8e912e68b5e3b960e75baf21dea49720852a2b6f87873a984f8237bf2dafe1e84faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277140, "uuid": "7026737d-2574-46a6-b3ff-ae3904af3c19", "value": "T19A2502422EC0DE01C1750F750D75784CEB74E2AA265CE9A4BC9CB2279F326A15B73BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277140, "uuid": "8140e0f1-3951-4a73-94f5-de86dde87e8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277140, "uuid": "7a415eb4-85f4-481b-a8e5-6a0ac9290696", "value": "24576:i7QQAf3nS8FX1+ZZ6jc2tdpDGhVjShOieQDi:iE3S+k/32tfSVvidi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277140, "uuid": "255cdd32-a2e1-4a57-8d76-8804494664c2", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277140, "uuid": "3cf91d22-e611-46a2-bab5-1067024cf767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277140, "uuid": "53ab43fc-55a1-4a0a-9cb8-7e5b6d1731be", "value": "ZTLLExog2fd6lcK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60288aa9-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648277150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277150, "uuid": "7b138af6-e606-48d0-8359-024d428c7ae6", "comment": "Malware payload", "value": "3dcdb977a492a52bf33b1ec478d968cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277150, "uuid": "06a8bbba-e1e4-4555-a329-ccfdf0e71591", "comment": "Malware payload", "value": "d80dcd1d4d7a1ec2885b9c7a59e90f3480cac248c5b0f7198a37cb736ec69ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277150, "uuid": "7ebda792-1947-435c-9885-de6a2b5b0351", "comment": "Malware payload", "value": "3fa79b60ebde1d428a83336cbb673fa4548c9752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277150, "uuid": "9954ef99-ea5d-4970-8c6d-53209666aa3d", "comment": "Malware payload", "value": "e7cc8c093f3be81b290c249cc97e22076f0a74138145b1a797ffe89acaf21ecfbe579bdd23cbaf50e3485b3542bd8166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277150, "uuid": "24f9315c-46e2-40d9-959b-f747ea1de4a1", "value": "T1A63512ADA7C35721C57E0A3BE5C4983A1256E3D8F6056FC752F1C324E271B12BC3A94A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277150, "uuid": "63f44f19-5afc-472a-8f3d-91a425229f73", "value": "9b455e8b0ec5a3088cc45448066b9793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277150, "uuid": "d9f2ae2f-4483-47e2-8f23-5efd56fbe2f1", "value": "24576:ApoRWoR7KuyScQyP53x6OPHnRf8zgq66qfloP1MEha+h:ApkWk7KuySc553xhiFqflM1MEQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277150, "uuid": "ee453e1c-4397-495a-be53-c115ade3747a", "value": 1107760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277150, "uuid": "057e798c-ffd9-405e-ada9-02b7fee7d134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277150, "uuid": "27ca0ced-bde8-4b61-b536-9267c2a77109", "value": "3dcdb977a492a52bf33b1ec478d968cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d22759-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1648277259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277259, "uuid": "bde7db44-7f56-4bb6-9de7-51994025f3f6", "comment": "Malware payload (NanoCore)", "value": "851ba9c532c090c8d3877834ee8b9fa6", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277259, "uuid": "024c7c64-ea32-4576-a7c1-fb2b650885d8", "comment": "Malware payload (NanoCore)", "value": "d8416cb263c6c4eb87cd8e9fdcb729fa269aed2055b4aba0d4f7991515d308bf", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277259, "uuid": "69b9561a-b8ff-4081-8d55-3c57ec3d68cd", "comment": "Malware payload (NanoCore)", "value": "06165da63b297b5b5c0c59fbe808ffc3a37c93fe", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277259, "uuid": "881d3019-39e9-410a-b3f5-881664a8dc6d", "comment": "Malware payload (NanoCore)", "value": "d1c55d0f50dfc130cc2497f7f4dd2815b5bb0b168a0c1fcd641983137e1663a73de8128a198a08da37c75e9a16c7bfaf", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277259, "uuid": "e393e81f-e9f7-4777-99f0-705ee37f594c", "value": "T10F14DF563285C425CA9857750CC2D2F12B33FD659FBADB8B32A0F31E2E736C0DA52166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277259, "uuid": "e6eae15a-ef0e-4de5-8b0e-0e56c041917f", "value": "6144:cxEtjPOtioVjDGUU1qfDlavx+W2QnAWO7vhlcQ9dZFiT9y6q8J83JP5ReTh:zO7zcWdXiT9y6IZPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277259, "uuid": "284695c8-daea-40a6-8095-098901419b57", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277259, "uuid": "76dafa40-8aeb-469a-9897-4d042ea61f3f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277259, "uuid": "dd873be9-5e0b-4804-8c5a-c5f6386d66f1", "value": "Fatura.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4473f43e-ad1e-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648310605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310605, "uuid": "9d87b20e-5397-4647-a0db-692f7a8689ad", "comment": "Malware payload (Smoke Loader)", "value": "895a19897543d03eda9d034153f55175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310605, "uuid": "4a965be2-a132-4f20-8b7f-d1695bfe8eae", "comment": "Malware payload (Smoke Loader)", "value": "d9b72da68db9eb3d54bfd70c71f9a07ef222b7d9662de35e74ba080b473df4e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310605, "uuid": "317cd3ea-c3f2-4369-b6e3-42719a5f37e8", "comment": "Malware payload (Smoke Loader)", "value": "3b667796848565707e56801a0a8946d7d2f911e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310605, "uuid": "4708c03f-8ab5-48ff-8bd8-b2fea4e25dd4", "comment": "Malware payload (Smoke Loader)", "value": "0e109b199593a8a1da2d46b5aa981822076f18717a5ac3855cf4926983208dc71eb4ab864e5492df96451ec664f759b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310605, "uuid": "72bb0bcb-bc23-4cb0-960f-6583d47d9216", "value": "T17224CF223680D032C45B46363478CAB51EBEB93117A5484B7BAD16AE6F303D253FB74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310605, "uuid": "fae7930c-928f-4e10-9514-3d15a0defb4a", "value": "67781d0bf9c76950c40acc9cf3035644", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310605, "uuid": "6d5ace22-a7ce-4279-8379-e0173a29dae1", "value": "1536:w7K9JehHT6H/odGkD2+vrd0O9T2DwI1nwgrYcGLDXBLEh5snnKCRYLze:w7K9JPoTp1I1wgrYcGL1g5sndoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310605, "uuid": "c7a702d9-a542-47eb-8ade-985152b6df5a", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310605, "uuid": "0a86b4fa-48ba-42fd-8065-b4bddbb91c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310605, "uuid": "7e2d291d-9939-43a2-b427-94944f400e1c", "value": "895a19897543d03eda9d034153f55175.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9e4e17-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1648269257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269257, "uuid": "0c79924b-2b03-4a54-977b-0ba714cde69a", "comment": "Malware payload (Downloader.Upatre)", "value": "cc41876131457380518803a6daed9fe3", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269257, "uuid": "a342dc7c-4dcc-4e96-b039-f3589d0db0c5", "comment": "Malware payload (Downloader.Upatre)", "value": "db57d70cb349c8db6a0fd0a43a7e2ac68edc258457c9cb6b6dbd19a3e348195c", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269257, "uuid": "3635982a-1078-44f2-9a3c-35bcf98a5295", "comment": "Malware payload (Downloader.Upatre)", "value": "352b01bbd7063ebbd3aedbe8e35408fd51584b1a", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269257, "uuid": "d49cb1fd-0053-4da3-b121-a99a3dc81b15", "comment": "Malware payload (Downloader.Upatre)", "value": "60d1dc0fe01c0438031b13e5da26a61ad13d6ca3712fd1d24919b4fbfdb778fb86b9e93ce5ca5a72910b8891ef78ed09", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269257, "uuid": "cf21c92e-48b7-4fb4-8549-7e60ff6ddca1", "value": "T128C217386EEA5A76F37BCEB6C6F555C6B930B4223D02580D409643850C23F66EDB0B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269257, "uuid": "6aa3cfc1-7708-47b7-b15d-deb7a765c452", "value": "cc40fefa3af5cd00cc28dbd874038a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269257, "uuid": "c1a7358a-bbef-443d-8ee5-6b4d93d3f619", "value": "768:v+dAURFxna4QAPQlYgkFlplVDuyUylyylylytlylySyPyb+L7Gdr/5syyoEdylYR:v6wosj+swB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648269257, "uuid": "637c34bc-fca5-4bca-a1d2-2e59e0e3842f", "value": 27738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648269257, "uuid": "1b0c8848-f137-4a3c-9882-81087edf93f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269257, "uuid": "d5fa4dae-b845-4ac8-80a2-7d04d35355a6", "value": "minor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda4d222-ad1d-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1648310378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310378, "uuid": "cdd475b3-3950-47d4-94c0-52eaa83be80b", "comment": "Malware payload (BazaLoader)", "value": "7360c8f6e793102af78c5cf61ee1ba88", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310378, "uuid": "13e00ce4-ff80-4d6e-b9bf-a16dd50bf76d", "comment": "Malware payload (BazaLoader)", "value": "dc933feffac8aabc920c5c80e3c3d76625c07281f8101d65240c693ff8658e20", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310378, "uuid": "4616c210-b935-437c-86ba-f6a04b681f82", "comment": "Malware payload (BazaLoader)", "value": "7b11c644fda96169c1b1ca91334f94b29b0957eb", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310378, "uuid": "8bea0c9b-a17f-4ed8-ac00-6c9fecb1949d", "comment": "Malware payload (BazaLoader)", "value": "6e2bf5f373fd894800a7b4b8d7484049e0f191286304cededcfbd721b430d4d672f21ea85cabc605f5c2ace6790e50c8", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310378, "uuid": "f6c1b4c4-1e66-4934-87f5-bead6613ded0", "value": "T1EBF4D06A66A837B4F0135474CD674A03CAB17C7127B191EB9793324B8D3ABE4173BB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310378, "uuid": "383094ac-941f-42ad-8126-52ee2a8c6568", "value": "64e5d7cce23479085f2b5c15b028487f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310378, "uuid": "28794fe9-30bb-4a85-b299-57b453aa19bf", "value": "12288:jb2Z46I1dVNykv7csRVVPRWYco1fQTBYPjffcvAFF5tyS7HI:jb2o1dXykDrRbPRWPQfRPL0vAFN7HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310378, "uuid": "ca371b99-6d23-4a6e-bbad-35fc7802b07d", "value": 728004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310378, "uuid": "5b22d4e8-f871-44fd-9d69-98233b965090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310378, "uuid": "94493c9b-7876-489e-8764-3fb5d196cabf", "value": "7360c8f6e793102af78c5cf61ee1ba88.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a464a17c-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648277265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277265, "uuid": "fdefb90b-c19c-45b8-9ca7-d898191c1d46", "comment": "Malware payload", "value": "4c5b18a1cedc0ff791f809198a3289de", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277265, "uuid": "1f30c771-f3f0-4a3f-a3f1-616dc18fbec7", "comment": "Malware payload", "value": "dda6c746a87c05400d60052f92d8003225be25c4afe3ebdefb5add274dc4a471", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277265, "uuid": "12144eed-fb1a-4da0-a20a-acde3ab9473f", "comment": "Malware payload", "value": "b5037835b5f91239deed0f3b1ac633e51597efab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277265, "uuid": "b7fc165f-05c1-4045-9ebf-263c84283358", "comment": "Malware payload", "value": "8f1d164d9b59d863d13efc55b867bd515edce7ff70bd07f8d0e04540c63d8915156ee26b5690bee8f2c0e6170dc48d7d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277265, "uuid": "a0d1913c-ae69-4751-8ad7-b74266c90dc4", "value": "T1617578F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E6E6551EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277265, "uuid": "bce662f2-be25-4007-8f39-f468530ee7fe", "value": "6144:slunbZKQrP0TCEi2KEeEgjARUxWWVWotg+HkqAgW99EQNKU0J33DTLMKMNORrvdj:s4bIi2tiA7JCEqAjFenolYxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277265, "uuid": "10c30b1f-44de-4985-9405-f8815615267e", "value": 1600877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277265, "uuid": "25581f71-514f-46f8-9f20-58d56e52f7cc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277265, "uuid": "000f8a07-4d34-40a2-84d4-2671d3d3700c", "value": "HBL Wire__ 20220325143337.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89168b27-acf7-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1648293969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648293969, "uuid": "5219e958-c572-49c8-bede-ff2b602d6dfb", "comment": "Malware payload (njrat)", "value": "ce36d722b60dd51444037c4435ab0a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648293969, "uuid": "2da9c3bf-d33e-4ea9-b994-42f99b85d698", "comment": "Malware payload (njrat)", "value": "def82eea2b57f5b879e8e7c14eb6e0c5a6cd58874835c53f0cfd4ee18d30101e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648293969, "uuid": "8d8d6280-5afa-4408-9bac-8d23a3b0d719", "comment": "Malware payload (njrat)", "value": "0628d364d08a4195fa757b524017fa0a0cbe1be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648293969, "uuid": "6a976de1-66d7-4411-aafb-6d8c83be1c8f", "comment": "Malware payload (njrat)", "value": "6e1c9697d45d43e6462fd432b3cc7df6afde3394c263c4fc04e8c3e525a551d33de4f69456520f7e212b049c2f243e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648293969, "uuid": "6ad8d6a3-adf2-4333-a34a-cd78d0b45c5b", "value": "T12A054C065BD41AB6C07EDB32D33441A482F86EAB0415E7EF1FE171E49B71B069B432A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648293969, "uuid": "79ed44c8-f7db-4733-8021-06db08c12c30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648293969, "uuid": "a35e69c9-36f1-472d-a31f-1eaafe99f0f1", "value": "12288:fGVp+bjgTI9nsskGSSO5iB+8nvtvHHNe:kpMgk9ssLmx8nvtvNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648293969, "uuid": "978d39b1-cacb-45aa-baa7-4a8761ed9443", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648293969, "uuid": "539386c5-9340-4857-82f8-6cb3f23ff902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648293969, "uuid": "f358c2f8-aba5-4f58-b53b-f6575e00463d", "value": "Confirmed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9d322a-ad33-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648319824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319824, "uuid": "40327a9d-185d-49b5-b848-98a0d20a9934", "comment": "Malware payload (Heodo)", "value": "e8e1c662d974f7b7f0cd7c15f268ca3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319824, "uuid": "f5e22367-6657-4838-aa83-d5c0b360825c", "comment": "Malware payload (Heodo)", "value": "e0887544f7c14abcbfceea5bbdb7bd2fa313c1bc73e1ea697f8d86308b03aa4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319824, "uuid": "83eca6d1-27d0-4c8c-840b-de4b9f162ebd", "comment": "Malware payload (Heodo)", "value": "d26c92c2f5872adcc3836c61012e2cc12a3f9849", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648319824, "uuid": "82cf2e63-c558-4cf3-abb0-f9a244ab9a1a", "comment": "Malware payload (Heodo)", "value": "3ed53884db5110dda8008ee6e87480a6ed97a4808a691e67e57f5482d8068f55b3414785216521fce9e4ecdb5c952d16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319824, "uuid": "b52ff1b5-df3e-4afc-bac8-f478c10ce8aa", "value": "T16C056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319824, "uuid": "c3e6f001-7623-4372-97d4-c7620b792006", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319824, "uuid": "2d12946e-4644-49f3-9902-4b25c6330208", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/ru5CGNHrH2tZ+d+:gMV/ru5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648319824, "uuid": "28ef8a81-f17d-404d-a8d3-d0ccbc6f93b3", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648319824, "uuid": "fe00c7ae-c6ed-4e11-9a55-a90389820b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648319824, "uuid": "928b875b-c611-4e73-9527-dfc57cdb449b", "value": "emot-gen.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0312b86a-ad27-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1648314360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648314360, "uuid": "cd760337-1652-415a-9664-4d0ecb984c0b", "comment": "Malware payload (DanaBot)", "value": "33f7000fc6b18aee48d787e09ddcd768", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648314360, "uuid": "dde153ec-5e73-4f26-a2fb-15e68dcb58c6", "comment": "Malware payload (DanaBot)", "value": "e1511e934906072c0717e68c0a05b04c61846f7ad15ce323b61f854a24c86b15", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648314360, "uuid": "298df8ef-2911-4ec9-844b-2b1423a90b01", "comment": "Malware payload (DanaBot)", "value": "65af9f145a741dc3bfde2309ad9d1e0a37bfde11", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648314360, "uuid": "5cd08e72-75e1-4c7a-9ec5-fc1f1a64f9e8", "comment": "Malware payload (DanaBot)", "value": "361fcd7bdea6669d094e561e71f9c6f391b6c2682c8aa591b7e8b370026ecc3489d1ddc030b9a9390b6dfe67ffaed4f5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648314360, "uuid": "7e6970b3-3918-4b1c-887d-d1f0b6ae496f", "value": "T1CC352311A941D03DC7460638282298E62F594A32469E1FCF9F9D135A6E703F0A7AFF5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648314360, "uuid": "7e6f02b6-b897-49d8-a324-0f870096a5ee", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648314360, "uuid": "14bb6c10-a8fe-438f-a8f1-44ebda7d92fc", "value": "24576:521pHZkUu40eoX4zuROs5obLOfkAnMNMo+C0OW/WS7H1S:qHZzu40ecUuFobafkaMNMo+plj7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648314360, "uuid": "bb0db69c-87ec-4cf6-a2f6-6644d4f090f4", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648314360, "uuid": "dfaeed14-e6ec-454c-b020-88ef2cad1387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648314360, "uuid": "4ba7b97b-249d-4c45-bbcd-d70654ee2d64", "value": "e1511e934906072c0717e68c0a05b04c61846f7ad15ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ad0dd1-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648268999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268999, "uuid": "7d3291c2-2519-4932-a9b8-709b0c41c5c1", "comment": "Malware payload", "value": "ab5e1b506c0b9a03092ed790d5a3f9bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268999, "uuid": "8b62237e-e352-4339-8d96-7db5aabcd339", "comment": "Malware payload", "value": "e4146ed7728604069095014f0bdf20a4f37e44ff8bd39371332261a55ae1a873", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268999, "uuid": "9cba0117-f6f1-406b-9492-2187693f3da9", "comment": "Malware payload", "value": "517de3f8bbb5eb6c30bbf8b0e396303385dde29f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648268999, "uuid": "6657dc3a-2b5b-467d-b174-27786639ac15", "comment": "Malware payload", "value": "aa2bafcbc0607b344c05bec3d8c62a014daeebe84ed6d2db736bd151cee6142582e6675d0a364e7dcc057cdd87445878", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268999, "uuid": "8e7fe538-69ee-42eb-837e-c0183eb3eed5", "value": "T162836C4076D1C0B1E67E5D3544A4EAB15F7E7921CEE08D6B3B46063A4F346C0DE36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268999, "uuid": "3ea0a459-fb24-47d0-a07b-b80b8f6c95c2", "value": "4a9c620a1047c16bbe4e14cfa3e4402f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268999, "uuid": "ad9bba6c-bd69-4103-95e4-1665408730fc", "value": "1536:m0o4bgsM7wmeV7lV8dWUDFrD1O4R+ZaYsWpcdy0gxwfPinm:m0o4nM0mIz8dWUDe8+s5y/xwfqnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648268999, "uuid": "34e9e70b-7c83-4c61-9707-f3a29aa187a8", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648268999, "uuid": "307929be-ce55-42a0-988b-bb20c5ae1eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648268999, "uuid": "a4ad3ab7-8df4-426b-8c62-dd3b1ec68fcf", "value": "axe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f240978-acdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Metasploit)", "timestamp": 1648283698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283698, "uuid": "17827021-54a0-4ed4-98d5-bb20819cb058", "comment": "Malware payload (Metasploit)", "value": "3daa1afb6edad335dbf2a755b70b1476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283698, "uuid": "a5cf8edb-9ab2-43f9-a882-c91f6d60f36b", "comment": "Malware payload (Metasploit)", "value": "ecd8c09d08b3e27f15c3cba89f8ec2b284c9caa728852da8155d5955cee2ed58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283698, "uuid": "1d795635-7f14-4849-b991-e5579d767cb9", "comment": "Malware payload (Metasploit)", "value": "3f9ed1297ffcee6fb72e956b2795be4b859e8a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283698, "uuid": "5f5c200d-eef5-40cb-b8fe-6f2dd3e9627c", "comment": "Malware payload (Metasploit)", "value": "fefa963ec747bc3aec51ef7262f78d261a6694a16342153bad6cc757057f1bb4b3658dcf3caa19b240fc4c4e90a3a851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283698, "uuid": "e268572a-0674-45c7-9af9-b2a1a00dffab", "value": "T18573AE41D9C42026D2A6117E23B63B75A9B1F6FA3305C19A798CCDF5EBC18B097263C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283698, "uuid": "6353c474-7667-4b49-bb71-2f5be2720bda", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283698, "uuid": "9195010a-aa24-4e31-9660-c7632b8537dd", "value": "1536:Ijxpo3VChn7ZDzD5dxY59Y4ym+4kcxMb+KR0Nc8QsJq39:8KVAnd/D5g+8e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648283698, "uuid": "0a398f95-41d5-479d-a74e-db6f6e875757", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648283698, "uuid": "e2dcdafb-2424-4023-b0be-0afde4d23bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283698, "uuid": "6af4bf11-311f-4193-8f88-d8b3898a6a0a", "value": "evil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4196ae9-acf8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648294552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294552, "uuid": "01d305bb-45d8-479e-a8a9-372f17a16935", "comment": "Malware payload (RedLineStealer)", "value": "f500488ce8fb39427f46d94c94582374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294552, "uuid": "4e1b9f4b-527c-4b9a-a3e6-f97c5a17285c", "comment": "Malware payload (RedLineStealer)", "value": "ef48aebc0f1e77208bbcd5206c58678bb1181994507d1084e1d324dca9d5d3b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294552, "uuid": "3e416c29-ff8f-4c18-9638-883e83755c15", "comment": "Malware payload (RedLineStealer)", "value": "8d657b7d0ab90d387a27e4713a11e21ed3c2c715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648294552, "uuid": "98339822-852c-4482-a6c8-52b17f2c3e60", "comment": "Malware payload (RedLineStealer)", "value": "2f1bb0511799f1292a8f3a5d1a6f53e1a4d9cd84ee7f161fd214eb8a5d5e0ba277cdc60793dac4747a7b29df1d22ef37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294552, "uuid": "0c8a8d52-ce17-46e3-9120-254ff453bce8", "value": "T1B624CF113540D032C45B16317879CAB42F7EB83213A5894B77AA0A7F6F303E267BA74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294552, "uuid": "e0ba0d0e-54d4-4a54-8bfe-a103c3fd2e68", "value": "2bdd43acf181bf5b35cc83a05996f85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294552, "uuid": "fd601de0-2bd3-4a4d-bf69-b9bc5fd1e0ed", "value": "1536:jXKy0n9QDzr10DY8drqoOP0T93nZcSsmDxQ12kdfGP+y65Sd6FMRhmiJszI:jXKy0nNmy93ZciDxQ45+F5Sd6FMRlKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648294552, "uuid": "6629d97d-207c-4ea1-be70-c3fc621d8862", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648294552, "uuid": "44c56c05-a50c-4652-ad67-f5c7ebe48c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648294552, "uuid": "98b78c8d-6b3c-4c10-a813-bea30b163ed7", "value": "f500488ce8fb39427f46d94c94582374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd85cba2-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload (Worm.Shodi)", "timestamp": 1648269254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269254, "uuid": "32b63704-6a4d-4cc7-b2e5-c08b0999f5a1", "comment": "Malware payload (Worm.Shodi)", "value": "849479ce376f7cef4280f8a42c6a38f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269254, "uuid": "c0fa8031-afd1-4967-9f5d-f14f34f41a85", "comment": "Malware payload (Worm.Shodi)", "value": "efa28ee2f92df886d710ce060bde7013ae7578de88523782e0effe22f2ad4a29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269254, "uuid": "8b208dd3-6ce6-4b9f-bacd-a1e4353695f2", "comment": "Malware payload (Worm.Shodi)", "value": "4ee6066d4fe65ea4c0805e55925369c3c73733a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269254, "uuid": "370b76d6-6a5f-4760-a629-d8809ee5521d", "comment": "Malware payload (Worm.Shodi)", "value": "0383de9c80cd34e46d120b10717ed38c3906002fc2f9eb6c41dd3a132a65c075ce41006d32ab99c9dcd94d24e33f0f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Shodi", "colour": "#472157", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269254, "uuid": "53f06b03-a96b-45c0-9fd2-ddcc3d43877b", "value": "T125D65D177BD480B5C06B423188D68A66EBB7B07A1B61538F576883DD1F232E09F39F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269254, "uuid": "02994855-541d-4ced-9bdb-f18420336ceb", "value": "49152:hrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSy:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648269254, "uuid": "d4e631f3-04a7-4127-90dc-2590b33d7e10", "value": 12896605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648269254, "uuid": "c15eb66f-08e6-4b2d-b879-8139229d3ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269254, "uuid": "16af7113-90a3-49e7-b64e-d47c7fd66cd8", "value": "big.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c9642e-ad4c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648330303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648330303, "uuid": "62388473-7a44-42d7-ac2f-c7961280ed53", "comment": "Malware payload", "value": "2d0de4198db872ea472cb18c192e977c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648330303, "uuid": "ca719e1e-5e36-4ae2-8f71-b0fb0dd3e7e8", "comment": "Malware payload", "value": "efdbfcb717b109b816e2d2f99c0d923803c70dd08fb9feb747eb90774e86116e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648330303, "uuid": "0e043422-d304-449b-82e0-e1338ca5c0ce", "comment": "Malware payload", "value": "2bd63726ca36b312f17d591f304125a38e6e01de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648330303, "uuid": "847a741d-4e78-48c9-83eb-6010db0eaeda", "comment": "Malware payload", "value": "4f565cfbc107db50cc03569fc171d8b0fdf6f7a0359450dfbc818965450c61b0f6df3d671387112121d9913e78b65e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648330303, "uuid": "88b3855e-c1a8-4ed8-8d63-f0d672b508dc", "value": "T162844947F2A2A0BCD16AC1788757A233F9327C0946257A7B27D0FE312F65B60A72D705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648330303, "uuid": "6305c288-a082-4afe-9fa1-356ac5eeb9d4", "value": "b3f6dcc1b4af5b5c34940f50a3e17687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648330303, "uuid": "4398da81-8020-4b57-a554-94b9c781e72c", "value": "6144:9mtI0sz21JaxQ5ULYFVO8UOWGM/gRjkiIy45S8dKiwoZfp:WI1zu8iGYz1xkbYiFdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648330303, "uuid": "e6311825-ebc5-42c1-afc8-734a817240c8", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648330303, "uuid": "f23287e6-67bb-4bc0-920e-ad60cc96e977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648330303, "uuid": "ccf24a24-14f8-42c6-9573-f13d0d2bf245", "value": "efdbfcb717b109b816e2d2f99c0d923803c70dd08fb9feb747eb90774e86116e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5556b465-acce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648276273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276273, "uuid": "bfb91cdd-2342-4578-abfe-4bc6f7365ccb", "comment": "Malware payload", "value": "e9224ddef21e75081f24a5daf07f93d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276273, "uuid": "e97672f5-c0e4-4bf0-8fa0-24f2853209b8", "comment": "Malware payload", "value": "f1b44cdae4edc7107c5323496060f73dbaca99900e2d310f0a57855b708db64e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276273, "uuid": "b5dd982c-9bda-4236-b54a-a015f7701062", "comment": "Malware payload", "value": "0b699acf6041749610b3eae5a3a53a29ec3b83af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648276273, "uuid": "49ffdf12-5777-4bc9-9b16-777d5240a7df", "comment": "Malware payload", "value": "d757931d357fd6a0fa9d0a03840d8ba66f343608f976cb626d6db187e16fb9c4f8226562d2da06b3f503209f8f3c9609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276273, "uuid": "b7a4267d-c88b-4a17-8ccc-8f3da0a312fa", "value": "T19B447D31E6C08577D0B11ABC9CDE9FB9A53E7D302D259495B7D93F0C9D782826A2C382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276273, "uuid": "7961a943-022b-467a-9dfa-7df80818ea6c", "value": "5ce35147bb0a1bb8c58f867d035db058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276273, "uuid": "c0e31291-7226-4170-abf4-c2cfc031166d", "value": "6144:Nr4EWX0bnalRAguj5/7V9PGAOAUYgTBUMO:NYEoAxj5J9OZAUYgTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648276273, "uuid": "8760bee2-9d11-496e-b65a-f47f9e539429", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648276273, "uuid": "2c9bfc6e-3a7a-4ddb-801e-ab507845969f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648276273, "uuid": "289fecee-8b32-46a8-a1a0-0e7f2fd254ac", "value": "11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db33dca9-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1648277357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277357, "uuid": "66e8f2b4-f1ec-4db3-857e-5461666e3565", "comment": "Malware payload (OskiStealer)", "value": "f5fffc343e9dda0bb4e7be9a76ccaa81", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277357, "uuid": "c688019c-6e9f-46bd-96f6-95ae205dd6b0", "comment": "Malware payload (OskiStealer)", "value": "f5052d7774eae6c14693e7c5826de8ee658916d121f26d27d76d7a23da1816a9", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277357, "uuid": "be023d54-7b63-4835-a956-3e313980e931", "comment": "Malware payload (OskiStealer)", "value": "9cdc3274e984cfe1811a33f7509ac5ce30bdf75b", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277357, "uuid": "ed549610-5f6d-462b-bd5b-1b9b4c4a875f", "comment": "Malware payload (OskiStealer)", "value": "d80d8c8c8cefbcdd8e065a05e5bec0608bc68d9b4f383d17363eccb31b4ea221c5507ea3efd89bbd62d055626c77359f", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277357, "uuid": "347ec072-557c-40fc-aa48-cb5f8a31d511", "value": "T14214121336A0B49AC2112973CD1BE0A2D8E1CD71541028FAA15635FD3478F91FAEFDB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277357, "uuid": "71776e7b-4516-426d-b2e8-1f72369853c3", "value": "3072:TJ+Kc28bVlsEHbsQV0dE7gfxnQrSC6n1V2mtRkI2zkwCYg+1pwr+KG/0pctupsp:9UBuebspdESnQGC61cmzu5h1pwrZG/0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277357, "uuid": "ae61d912-8421-4a4b-8354-4a7255968dbe", "value": 192120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277357, "uuid": "65d037bc-c296-401e-8b0a-b152da1b9bf8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277357, "uuid": "fdcf5da7-5905-409d-a5fa-f17418d57d6e", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cabf89-ad37-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1648321286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648321286, "uuid": "acc8bc39-594b-464f-919f-aef58200e7a9", "comment": "Malware payload (QuasarRAT)", "value": "7f0994266ca6932d6ffaef01fb46f3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648321286, "uuid": "433ff5f6-5a62-4580-a4f5-8f2cad4bd085", "comment": "Malware payload (QuasarRAT)", "value": "f5a57218a5047acc47859185bfdb93ed8ad0ee4ad7475cae24ebffe518569146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648321286, "uuid": "4d95644f-e87a-463a-8b80-c057f7e37883", "comment": "Malware payload (QuasarRAT)", "value": "1729b91cbe1d8259c3f3addba06f9b4d8fafbfc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648321286, "uuid": "cc29bcf3-e299-49a1-9b23-1210b74ea4e4", "comment": "Malware payload (QuasarRAT)", "value": "14b2eedc6239e0eb0c43eb79969d77ed770bcebe0a4313855f92750dc18e2fc02e732586f6f11e981d90b8ac394cfe40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648321286, "uuid": "87db2488-54bc-4aff-b982-bb0b01751ec2", "value": "T1DF55BF2A1BEF4D01D16F83B1A7B514F85732F30AE7A2E329046E915F5D3138453A2FA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648321286, "uuid": "9de7cf89-6244-4ade-ab58-4384cc2cbbd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648321286, "uuid": "dfbb3a4b-535c-4be0-9685-60fc4788a020", "value": "24576:hzgON0iIHBrHd0anQJAlfUeLUinLPjdOPFvNMBfY:hzbEBrHKoNbcvEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648321286, "uuid": "ab3159e6-4d65-4cc7-9705-1dbc24d9e492", "value": 1397592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648321286, "uuid": "c49cc125-e841-4a20-b926-f170ceade572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648321286, "uuid": "aa9374e8-b04d-416e-96ee-e7e2aecbbf68", "value": "7f0994266ca6932d6ffaef01fb46f3ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8a373b-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648277143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277143, "uuid": "f92546af-73d6-4f8f-9e23-e9579d63f0a0", "comment": "Malware payload (SnakeKeylogger)", "value": "8cca5c566a48e64cceab9c73dbbde481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277143, "uuid": "c0e55ac2-04f7-4a2e-81f1-6fd30d31c00b", "comment": "Malware payload (SnakeKeylogger)", "value": "f69b3aec41d733f9a32066220188a064e26a2399beebf5ea2f722ef4adbc2cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277143, "uuid": "388ca35a-ef35-4f2e-94da-bcf150cb1ea7", "comment": "Malware payload (SnakeKeylogger)", "value": "e83d0847ac6bae51c8de96863735870185205e14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277143, "uuid": "245ed22f-54f4-458a-b624-ec3288f35a12", "comment": "Malware payload (SnakeKeylogger)", "value": "fb761f459097366017ff88d40898fdeaba97218d0ed07fab6b69d2f79b242abf18c29b1fd4b2429bcca6b03b2df46ab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277143, "uuid": "ce8f14a2-3ae1-4f44-b92a-3d8ee085044e", "value": "T1432512021DC1DE02C5720F714C757489E731E3A6669996A4B8EC70778E32BE09BB7BC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277143, "uuid": "a10aa0fb-1593-4f39-a393-c4f0a35a11a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277143, "uuid": "44e06de1-06e9-44c5-8168-24026a54dbc5", "value": "24576:Sht1UZpwjXkL8vKLSbGmUsSso/aLcXgn/AiDSpEQz:SVUZpk0wvKLSbGmUQo/AcXgn/ueQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277143, "uuid": "29d136a6-066e-45c9-99b3-fab67832a138", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277143, "uuid": "5986990d-0b93-443d-a036-955c0edbee0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277143, "uuid": "929e54ef-cb1e-4694-bceb-539c21124d01", "value": "PDF AUTO MACHINE RFQXLXE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4762ef94-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648277109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277109, "uuid": "2d3ae19c-0a07-4b03-b389-8b3a990b0115", "comment": "Malware payload (RedLineStealer)", "value": "fbf5141ddf7328f8a5cb9b2b695d1b73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277109, "uuid": "9025b940-f098-4366-8d55-6e310be6174a", "comment": "Malware payload (RedLineStealer)", "value": "f6c36a703fd9bc50a671934cc7a85c61760c4d918c344a5bbaefc860a1e7057e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277109, "uuid": "eb32ee41-4cc1-4cde-bb80-462120d3c141", "comment": "Malware payload (RedLineStealer)", "value": "afdb1dbd1a8c4a6887488efebbdfa70f65c4d1e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277109, "uuid": "15d0b1f9-598a-4d9b-b523-ecb7af4d514e", "comment": "Malware payload (RedLineStealer)", "value": "de1fbb605dc262bb3665a9cf1f6f296a7ec90413b3dac9edcd2b1545abc313f346fafc63bfdd42c31ed02b542596b63a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277109, "uuid": "cadf2934-2e50-4648-b30a-4dac5f47872b", "value": "T1684512D9E3C9E924D05E0177E499D0751750FEC6723A2B6B6BC89F8BF320B86B874241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277109, "uuid": "92d6bc19-5aa0-4064-aa8f-80ed1f0b5c44", "value": "c437d16bf0fef4c8552d9c16e0b7bffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277109, "uuid": "e1b0edbe-22b6-4f8d-9621-e1a4c82c49e6", "value": "24576:4XGxmOXgOg4YljOJuQqJcvB8Yxf9knWIHWjtve23tO:xmOXgORYlj6nsTYxf2nWrjVe234", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277109, "uuid": "33865e31-ec5a-4363-9422-8404e3bf0fc1", "value": 1276320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277109, "uuid": "715a0bc0-38e3-43f7-b50f-6ab05a28885e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277109, "uuid": "7b780c6c-4c27-4465-8027-80727cb581e2", "value": "fbf5141ddf7328f8a5cb9b2b695d1b73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f55b70-ad1d-11ec-9275-42010a9c0029", "comment": "Malware payload (SystemBC)", "timestamp": 1648310199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310199, "uuid": "7913b556-8aa3-4c80-b481-ec3f0c7c723c", "comment": "Malware payload (SystemBC)", "value": "a7cbdc69144242409bce8285135b61f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310199, "uuid": "66bd8b40-64cc-4cd6-a9ad-7085fa327901", "comment": "Malware payload (SystemBC)", "value": "f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310199, "uuid": "0f8f887b-752a-44a8-88b5-d7cd78930a27", "comment": "Malware payload (SystemBC)", "value": "73594de56be8beaf92392af56c8bcc2fa44a6eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648310199, "uuid": "71f53b51-dc97-41ae-9895-f0562ca80d90", "comment": "Malware payload (SystemBC)", "value": "6a7a409c3fe7fa6dc248edc44c97050758365429fd73e0ad06dcd43efb4b13238d4d02616bd818a53b9d7fa2905808e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310199, "uuid": "8e0aaf68-4834-4de0-b949-ae9a29918da2", "value": "T1DF24D0223690D031C4871A71B439CAAC5DBEE93117760E4B37A9167E5F303D1AABB74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310199, "uuid": "b2877d48-ac33-4431-8335-427dc33d8c69", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310199, "uuid": "1c665059-4f89-43c3-86b8-f79e583dfd28", "value": "1536:3pKr2jztTQudAGkD32Vrz0O1gtLA6q88vwzk/KYO1jD+fbPp8U45INU5h2lx//9I:3pKr2asc3+9yYO1jkLp8x5IiCx//9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648310199, "uuid": "704fc435-2a13-4747-9198-01fd89e98d27", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648310199, "uuid": "b3a10229-7fd2-4e8e-a9b2-5c594f30938b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648310199, "uuid": "7f9960f3-39e1-466d-92f2-b65b2f2ff86a", "value": "a7cbdc69144242409bce8285135b61f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb96f32-acd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648277197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277197, "uuid": "58253731-13d6-47aa-b54c-20e5ba4fa23f", "comment": "Malware payload", "value": "58c04f58f473da2670fc487cd2bb4906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277197, "uuid": "2fd37b20-d07b-4eea-b5e7-2c6785cf389d", "comment": "Malware payload", "value": "f898e35329ae242f1f8c0e64efde783e9742671336598ad9824073decae40f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277197, "uuid": "711df3ee-a0d1-4afa-9395-9345e15e0a29", "comment": "Malware payload", "value": "eac9ca0ee7a9793b5d419c61f48660c7d7e7c1c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648277197, "uuid": "b822ff75-b6a5-4a90-8fae-43ecc209e30e", "comment": "Malware payload", "value": "274f9d029b0c5ce4af52a9cd61d6d235c814d4e1a8f0cf4966fad0d6c471994e0c884fcc3b750719c794f5dec0fcdd64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277197, "uuid": "67ee0404-7f3a-4400-b5ec-5654f5c1db2e", "value": "T19DC4F110BB90C035E1B761F4497AD3AC793E7EB16B6454CB22E25AEA42345E0FC3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277197, "uuid": "af02ebc0-6dac-45d3-9133-b54ea4828e78", "value": "e8b02652dda4770f34817322f629975c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277197, "uuid": "3dd48105-e600-4281-be68-46a5489fe7a2", "value": "12288:uPaY0U4t3vD6JGQxvsVuKLevOnV/zNuxTxjc34u:40vZeh1sMUBnBsxdjcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648277197, "uuid": "6f546d30-4f8c-4c68-a878-3c51a300ea5e", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648277197, "uuid": "a26aed60-b427-4947-a7f5-ed1c6d0837ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648277197, "uuid": "e51976b4-1074-456e-8dd7-b30b13948404", "value": "58c04f58f473da2670fc487cd2bb4906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01bdfca-aca3-11ec-9275-42010a9c0029", "comment": "Malware payload (ZeuS)", "timestamp": 1648257930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648257930, "uuid": "0ce46e19-c284-4d65-98aa-bcbc49103b8d", "comment": "Malware payload (ZeuS)", "value": "b048524d77d04b45d39069074c5692a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648257930, "uuid": "b0fc6a18-742e-421a-977a-4c5e291e38c3", "comment": "Malware payload (ZeuS)", "value": "fa3d1e0d938aea74098020ca657c0e138a88a25c267a90730cb603780621fb14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648257930, "uuid": "97bd8e9b-69d9-4723-91c1-d543156b7682", "comment": "Malware payload (ZeuS)", "value": "ccf908a46f10fd21bdd374c92941322ae29ba0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648257930, "uuid": "70264169-09bf-4602-9341-5912078890fa", "comment": "Malware payload (ZeuS)", "value": "c3362c72e74461e23981acbd1b91b189705cacb450479513c800b6299fdf24f7b1286a16880a4e634132dbe06184d530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648257930, "uuid": "b3c4fe5c-0eb8-4ddc-9733-c58482d89140", "value": "T188737F2273B1C671C4B9C530AE4DDB29AE7A683414FD78E69E49D9833620FF2901F785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648257930, "uuid": "45becf72-f669-4293-a717-3f393d605188", "value": "1536:wBqYproJgcOIpQiCnIflp5lEZMX0z8h1/6vlVn5Ys:wBqY9oucOrclJOQ1GlIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648257930, "uuid": "48f10f54-a320-4dd3-b154-d9c9df3b4f27", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648257930, "uuid": "56d08f11-8c2d-4fe7-a5b1-952f85a57e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648257930, "uuid": "6f5273e8-bbf2-4d62-8421-231bcfadbfa3", "value": "fa3d1e0d938aea74098020ca657c0e138a88a25c267a90730cb603780621fb14.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c414df1-aca4-11ec-9275-42010a9c0029", "comment": "Malware payload (ZeuS)", "timestamp": 1648258246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258246, "uuid": "9c4f9da3-e820-422c-ab9f-8c2ef394ce87", "comment": "Malware payload (ZeuS)", "value": "209c148cf6e1f4a7f3159b4e135b5980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258246, "uuid": "68696fb6-8372-4064-8062-9ba4df31d4df", "comment": "Malware payload (ZeuS)", "value": "fa4b250a594d746f135c06cd5a8ae9b544fb143c86e77f14add777c54f59e21b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258246, "uuid": "c420a7bc-a9d6-4520-8b87-d2fb2bacb968", "comment": "Malware payload (ZeuS)", "value": "86ca91071680ca8b2ee42ba3d0d664d2dfd9ab96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648258246, "uuid": "bf54e357-c2be-41f3-906d-ca6e25d6bde5", "comment": "Malware payload (ZeuS)", "value": "b8ce07a54c63d938bbd61276dd191cfbc9036b329790214f873e2bc0bdf61aaf933118343f2b56d907237c909f3180ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258246, "uuid": "976af565-1444-4f6b-b9c5-7ea8a397bd8e", "value": "T14F64122133D05573C0F581329E8797A24E47A426B1AB55EB8C358B579D42F82EB3F38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258246, "uuid": "01d70fc9-b511-471f-8969-3cebeb7e3353", "value": "5a01928e8568ff143db3a37da1734dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258246, "uuid": "b1f2d10d-c7b8-485d-ad16-147d3a27a66f", "value": "6144:lBV8n1SvZzGcYV+jrWMuyGfERp3Vk1XHLJDRO6t9vK:l813QrW/y8EL3VED0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648258246, "uuid": "7f6354fc-8b12-4645-ab3b-edff21e3965d", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648258246, "uuid": "83dc1cf0-85db-4453-952f-6d6cfb870534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648258246, "uuid": "aa65933e-cd79-418f-8642-920fd2313e4c", "value": "fa4b250a594d746f135c06cd5a8ae9b544fb143c86e77f14add777c54f59e21b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce51d83-acd6-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1648279614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279614, "uuid": "c54f9792-4a92-45ad-af98-11522730afd0", "comment": "Malware payload (OskiStealer)", "value": "46ed02de5213530c183cc769b063b923", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279614, "uuid": "a803dd70-3241-48f0-bfbf-c478fccf4242", "comment": "Malware payload (OskiStealer)", "value": "fabe67cd06d71d24a03fe0d11e62e975de4c58903bcbc35f48a3a566970c228c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279614, "uuid": "370d387c-2f52-426f-af81-31f3fb95446a", "comment": "Malware payload (OskiStealer)", "value": "fefa710b6206b86054a5b04a50a433750f97df02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648279614, "uuid": "8289f00b-60af-4626-bcbc-d16d55c3214a", "comment": "Malware payload (OskiStealer)", "value": "04109fb1ff3b39957fecb0946800d51906647dc057ccb29616e1a304ec1364fbb19a5e65a2497cda65aa423fd2d1557c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279614, "uuid": "179a9d1e-fcb6-45f0-a0ca-45aa497f32c3", "value": "T1CA3512162DC0DE12C0B60B314C747488E735E3B76128E6A4B8DD213BAF727A55B67BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279614, "uuid": "f8a6ca17-0082-407a-a06f-83ba5a4726aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279614, "uuid": "3247dcd2-74c9-4fc7-8e0c-32743a83df7a", "value": "24576:NfpNFyC9GrweFJu+NcN7sKzpnmMiaMyXehrXOd+3M2WSAIlt9atq:NRyC9fee+NMjzpTfse92Tl/a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648279614, "uuid": "5407a89e-3b98-405c-bd09-3524cbad95de", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648279614, "uuid": "e5cdcd5d-238f-4df3-ba40-c25843e23f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648279614, "uuid": "349b6bc4-532f-4cd9-8f1d-011e47349e42", "value": "46ed02de5213530c183cc769b063b923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f3be6a-acbd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1648269240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269240, "uuid": "c937f4a0-3162-47af-b5f6-891ee4473980", "comment": "Malware payload", "value": "97bd4394198a5b14661bc01d7f102471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269240, "uuid": "a1d7206a-9875-4da6-b55d-a9fc9f1faa29", "comment": "Malware payload", "value": "fbd0dd6cfa4c80e07edb97767d169ec45066a58b9d2fd475be13bc4a7cc4dfa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269240, "uuid": "76ed8b78-ba7e-46e0-8cf0-b900ef8d8cda", "comment": "Malware payload", "value": "67134610f73eaea53fd44df3d85579ca936971ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648269240, "uuid": "d1f5eba6-afa6-454a-9e18-505a8ea11dae", "comment": "Malware payload", "value": "986371fe962d431c20df3f61a14e934aa1acd72dbf32ebcf5df3a0c301ccbacca3e26d153bbc1ba26577cf9f4147af21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269240, "uuid": "be976e60-5445-4313-a5f3-b64a6130385a", "value": "T188647D117682C072DA7111335638AF72897EBC314F2556EB63D41E7EDE302D2AA31F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269240, "uuid": "f71bd359-23e1-4a1b-b928-f7a89eac5dee", "value": "9de17dc59bdcd2622d279de0de7d4bef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269240, "uuid": "441fceda-6ce6-4658-b0b1-a9e3bc2f2ce3", "value": "6144:2T7LVBMXNv0uls6ONqv01j0zs+lK16UQiokvuJaIMnlweh2AOzbWOs/Dv:2TPA9vdls6ONqcvMiuJaIMlENU/Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648269240, "uuid": "18061177-300f-4952-bdf7-ee25e60d8168", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648269240, "uuid": "ca75c191-ccbb-404c-a1ec-7e7b9f878600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648269240, "uuid": "eebb4869-fdef-4514-83fa-80400dcb235b", "value": "noun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf8d085-ac97-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648252877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648252877, "uuid": "07b900a8-9266-46da-82b9-5160f384302a", "comment": "Malware payload (Heodo)", "value": "e06f30bbee50eddd65a8b09b6c8847ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648252877, "uuid": "7b21a6ad-84a0-4bf0-b386-fcd5ec9165f4", "comment": "Malware payload (Heodo)", "value": "fc3c67181fc0d5a7374a38120e68a1ff20acc43c3b3f9912814782345fcf99ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648252877, "uuid": "115319b3-3b55-494c-9fe1-5b2f295ac4f9", "comment": "Malware payload (Heodo)", "value": "8b3d54f19bb8c4522fb770ff953d3fdfebca00b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648252877, "uuid": "24110b81-1dee-4998-bc6a-daf3c575d893", "comment": "Malware payload (Heodo)", "value": "7d678506b4291c91e8759ab5399735c60130aa01cec0535f648e6e9c6b3d0a039d762dcbf7187d2c64b9c84f04238260", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648252877, "uuid": "be2580cd-f330-437d-9938-cf4beba7b71f", "value": "T107D47C0EFFD1C1B2D36B123019D5C64823ADBF2CEAA1C5B777A8BE1D69326C14512B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648252877, "uuid": "bdabc9fa-535a-46a1-af4e-1d21c6906459", "value": "d63ab94f4bb6b5d2f0f6092bf07e00ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648252877, "uuid": "4d1fe7e4-0e7a-4548-ba8a-7b9d14c5441f", "value": "6144:/6ZMFXzqfoSHr/mvcQYbi2HN8C8BgifO7y7BcuVqrWLWN7Ypsi6Ih9vH0/oUHahE:/8MFX47ivcQMNsrDGKJjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648252877, "uuid": "fb299e6b-e60d-4d67-aee3-228f1a0895b8", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648252877, "uuid": "f0298fac-54cd-424c-958f-ff7a0afbe740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648252877, "uuid": "04d1081e-4308-4207-8fc7-d4993ab2d3f9", "value": "emotet_exe_e4_fc3c67181fc0d5a7374a38120e68a1ff20acc43c3b3f9912814782345fcf99ce_2022-03-26__000112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93624e95-ad12-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1648305583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305583, "uuid": "bf9a2370-621d-43c8-b91c-a4012f0211ea", "comment": "Malware payload (Heodo)", "value": "4677093c3ac1a79082e351dde6880a25", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305583, "uuid": "21dc9252-32e5-4587-ac11-2f2f1f3de07f", "comment": "Malware payload (Heodo)", "value": "fc664da216f1fbdf57cff4bdb02d8f6bff8a34272964b93fd72fc53d7c1029ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305583, "uuid": "35502276-8f33-49f3-bfa8-74e739588941", "comment": "Malware payload (Heodo)", "value": "4c4f1782b6dfd381fdf34455197f8cf09d5b03fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648305583, "uuid": "1b115dff-077d-48ff-a79c-0df1a55b9612", "comment": "Malware payload (Heodo)", "value": "f2f6d9f7a6e1eeeec7719b9e194aa96b853edd872b342386966a4db9e248cd0f0f70ffaeae6dc93d50f0ab83578c0c62", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305583, "uuid": "9dadc33a-0ac8-4ea7-aa21-85d009bb6b03", "value": "T1DE34FF7D0FAE0052CC621770545C0FD991ABCA25BB125AFF24992E2E2EB57D708B9F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305583, "uuid": "0004a4fb-8b65-45a5-b2a6-1ee5efabddef", "value": "1536:0wAjC++znd222222dccccxjjjayfzzzf2222cfiu8xrdxHNHNEBQdKELL4Ot4Otf:rA5pcWyfJCALTQML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648305583, "uuid": "dfec9623-ec1e-47f8-b959-1a752d5a73e6", "value": 245274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648305583, "uuid": "d127cad9-d384-472f-80c1-d24170b902fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648305583, "uuid": "a89c955c-e7b2-49bd-9255-f545b33dbce3", "value": "emotet_exe_e5_fc664da216f1fbdf57cff4bdb02d8f6bff8a34272964b93fd72fc53d7c1029ec_2022-03-26__143938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e561bf6f-acde-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648283387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283387, "uuid": "6d8d7a19-c496-4c50-994e-4344754a5deb", "comment": "Malware payload (AsyncRAT)", "value": "7a37a32659ea477a5b5fbb49135ac1b4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283387, "uuid": "15c2cfc0-9a68-4179-b3c8-6c1e43c88cca", "comment": "Malware payload (AsyncRAT)", "value": "ff3df6e74b6eb27f5dbe734d78ca97937d121df09149bba70d2bd1fb151bb56b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283387, "uuid": "358130c1-27e2-4743-8ddf-2f7dd9c512ee", "comment": "Malware payload (AsyncRAT)", "value": "24ab4fa4ae2fc707249445565e720dcc97634c03", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648283387, "uuid": "b8a3d3a0-5350-4580-8da9-d67bc7298407", "comment": "Malware payload (AsyncRAT)", "value": "2a0ba6565269404ddef6887baadd5c04e8308d9a0c23bda441af8541affb172904def3824a5b7a1b103a98a326a8f5d2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283387, "uuid": "24af762c-6174-49aa-a5d9-aceb6dfa9a24", "value": "T1B5230A003BD88137F2BE5FB898F26245867AF2633603D5496CC451D75A23FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283387, "uuid": "b99b835b-2443-47a8-9978-7db28181dbe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283387, "uuid": "3631b3b8-cf2d-4287-9a31-33a984405a52", "value": "768:EuGs1THwoPNWUtmT1MHmo2qzXwqsKkPICzjbCgX3iLxk+XdzyFvn644Kwd2BDZTx:EuGs1THb01m2OC3blXSdndzmvn1XwdYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648283387, "uuid": "5464d737-a55f-4450-9d40-a9286498c7ae", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648283387, "uuid": "6ea9837c-e39f-48f4-81d8-3d60e7e9d2d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648283387, "uuid": "cacbc41f-3046-4698-af8d-5501038ee88e", "value": "20222222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }